Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 05:47

General

  • Target

    796ed4b0db9b3d50149b39c35c97fb22.exe

  • Size

    2.8MB

  • MD5

    796ed4b0db9b3d50149b39c35c97fb22

  • SHA1

    154fde51c43d3a8b8f1b96df04f3e97fe4c922a6

  • SHA256

    37db478cd1a50883e179c601987b3a5171823aaa9d04063817fa7af57723ffb7

  • SHA512

    762989d2993cc2431b50ae9a2847cc3b16bce41c15da9a974dd90c66884ac28b32698edbf9d13b948d7b1f22919278b43e4448710dda2b2489b509bd6ecf00c7

  • SSDEEP

    1536:qfoDCSHH6dNPdeGb0kMzA1UYaER0XBi3IGd0b15grKsYmhUeogKGiGDaLm8G/BaI:O

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Client

C2

dontreachme3.ddns.net:3604

Mutex

EdgeBrowser.exe

Attributes
  • reg_key

    EdgeBrowser.exe

  • splitter

    123

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • UAC bypass 3 TTPs 5 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Nirsoft 1 IoCs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 15 IoCs
  • Windows security modification 2 TTPs 13 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks whether UAC is enabled 1 TTPs 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 61 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe
    "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Windows security bypass
    • Checks computer location settings
    • Drops startup file
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5100
      • C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe" /SpecialRun 4101d8 5100
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2756
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2896
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1376
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4440
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
      2⤵
        PID:3616
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1080
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe"
        2⤵
        • UAC bypass
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:868
        • C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\AdvancedRun.exe
          "C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1004
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\test.bat"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4984
            • C:\Windows\system32\sc.exe
              sc stop windefend
              5⤵
              • Launches sc.exe
              PID:5452
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5844
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5884
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5928
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" -Force
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5996
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6088
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout 1
          3⤵
            PID:5808
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              4⤵
              • Delays execution with timeout.exe
              PID:5752
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe"
            3⤵
            • Executes dropped EXE
            PID:3324
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Delete /tn NYAN /F
              4⤵
                PID:2852
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe" /sc minute /mo 1
                4⤵
                • Creates scheduled task(s)
                PID:5460
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1852
              3⤵
              • Program crash
              PID:5488
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1360
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:320
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" -Force
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:552
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c timeout 1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2404
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:5748
          • C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe
            "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe"
            2⤵
            • Checks computer location settings
            • Drops file in Windows directory
            PID:5432
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Delete /tn NYAN /F
              3⤵
                PID:5464
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\796ed4b0db9b3d50149b39c35c97fb22.exe" /sc minute /mo 1
                3⤵
                • Creates scheduled task(s)
                PID:5864
              • C:\Windows\EdgeBrowser.exe
                "C:\Windows\EdgeBrowser.exe"
                3⤵
                • UAC bypass
                • Windows security bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:3864
                • C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\AdvancedRun.exe
                  "C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                  4⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4676
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1580
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3456
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2508
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4316
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1240
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout 1
                  4⤵
                    PID:6060
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      5⤵
                      • Delays execution with timeout.exe
                      PID:5752
                  • C:\Windows\EdgeBrowser.exe
                    "C:\Windows\EdgeBrowser.exe"
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3460
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Delete /tn NYAN /F
                      5⤵
                        PID:5632
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn NYAN /tr "C:\Windows\EdgeBrowser.exe" /sc minute /mo 1
                        5⤵
                        • Creates scheduled task(s)
                        PID:2972
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 1756
                      4⤵
                      • Program crash
                      PID:1436
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 1756
                  2⤵
                  • Program crash
                  PID:5836
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 2320
                1⤵
                  PID:1868
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 868 -ip 868
                  1⤵
                    PID:440
                  • C:\Windows\system32\sc.exe
                    sc stop windefend
                    1⤵
                    • Launches sc.exe
                    PID:884
                  • C:\Windows\system32\sc.exe
                    sc config SecurityHealthService start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:5804
                  • C:\Windows\system32\sc.exe
                    sc stop WdiSystemHost
                    1⤵
                    • Launches sc.exe
                    PID:1500
                  • C:\Windows\system32\sc.exe
                    sc config InstallService Start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:4160
                  • C:\Windows\system32\sc.exe
                    sc stop InstallService
                    1⤵
                    • Launches sc.exe
                    PID:2268
                  • C:\Windows\system32\sc.exe
                    sc config WdiSystemHost start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:1800
                  • C:\Windows\system32\sc.exe
                    sc config WdiServiceHost start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:928
                  • C:\Windows\system32\sc.exe
                    sc stop WdiServiceHost
                    1⤵
                    • Launches sc.exe
                    PID:4736
                  • C:\Windows\system32\sc.exe
                    sc config wscsvc start= disabled
                    1⤵
                    • Launches sc.exe
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3616
                  • C:\Windows\system32\sc.exe
                    sc stop wscsvc
                    1⤵
                    • Launches sc.exe
                    PID:2324
                  • C:\Windows\system32\sc.exe
                    sc config SDRSVC start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:3816
                  • C:\Windows\system32\sc.exe
                    sc stop SDRSVC
                    1⤵
                    • Launches sc.exe
                    PID:3688
                  • C:\Windows\system32\sc.exe
                    sc stop SecurityHealthService
                    1⤵
                    • Launches sc.exe
                    PID:4484
                  • C:\Windows\system32\sc.exe
                    sc config WaasMedicSvc start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:3508
                  • C:\Windows\system32\sc.exe
                    sc stop WaasMedicSvc
                    1⤵
                    • Launches sc.exe
                    PID:3860
                  • C:\Windows\system32\sc.exe
                    sc config usosvc start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:704
                  • C:\Windows\system32\sc.exe
                    sc stop usosvc
                    1⤵
                    • Launches sc.exe
                    PID:3364
                  • C:\Windows\system32\sc.exe
                    sc config wuauserv start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:3764
                  • C:\Windows\system32\sc.exe
                    sc stop wuauserv
                    1⤵
                    • Launches sc.exe
                    PID:3652
                  • C:\Windows\system32\sc.exe
                    sc config Sense start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:1760
                  • C:\Windows\system32\sc.exe
                    sc stop Sense
                    1⤵
                    • Launches sc.exe
                    PID:4692
                  • C:\Windows\system32\sc.exe
                    sc config windefend start= disabled
                    1⤵
                    • Launches sc.exe
                    PID:2156
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e8a9de02-0594-4d3e-9afc-2e8d01ca4dd4\test.bat"
                    1⤵
                      PID:5960
                    • C:\Windows\System32\sihclient.exe
                      C:\Windows\System32\sihclient.exe /cv M0nPrqn9l0uxnPFE5ym+WA.0.2
                      1⤵
                        PID:5808
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3864 -ip 3864
                        1⤵
                          PID:4996
                        • C:\Windows\EdgeBrowser.exe
                          C:\Windows\EdgeBrowser.exe
                          1⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Checks whether UAC is enabled
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:3652
                          • C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\AdvancedRun.exe
                            "C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2716
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\008d5608-fb82-4b14-a4f4-16aeb5d00930\test.bat"
                              3⤵
                                PID:4484
                                • C:\Windows\system32\sc.exe
                                  sc stop windefend
                                  4⤵
                                  • Launches sc.exe
                                  PID:3196
                                • C:\Windows\system32\sc.exe
                                  sc config windefend start= disabled
                                  4⤵
                                  • Launches sc.exe
                                  PID:1912
                                • C:\Windows\system32\sc.exe
                                  sc stop Sense
                                  4⤵
                                  • Launches sc.exe
                                  PID:2944
                                • C:\Windows\system32\sc.exe
                                  sc config Sense start= disabled
                                  4⤵
                                    PID:4736
                                  • C:\Windows\system32\sc.exe
                                    sc stop wuauserv
                                    4⤵
                                    • Launches sc.exe
                                    PID:6052
                                  • C:\Windows\system32\sc.exe
                                    sc config wuauserv start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:4660
                                  • C:\Windows\system32\sc.exe
                                    sc stop usosvc
                                    4⤵
                                    • Launches sc.exe
                                    PID:4000
                                  • C:\Windows\system32\sc.exe
                                    sc config usosvc start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:4752
                                  • C:\Windows\system32\sc.exe
                                    sc stop WaasMedicSvc
                                    4⤵
                                    • Launches sc.exe
                                    PID:2268
                                  • C:\Windows\system32\sc.exe
                                    sc config WaasMedicSvc start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:4884
                                  • C:\Windows\system32\sc.exe
                                    sc stop SecurityHealthService
                                    4⤵
                                    • Launches sc.exe
                                    PID:3744
                                  • C:\Windows\system32\sc.exe
                                    sc config SecurityHealthService start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:4160
                                  • C:\Windows\system32\sc.exe
                                    sc stop SDRSVC
                                    4⤵
                                    • Launches sc.exe
                                    PID:4424
                                  • C:\Windows\system32\sc.exe
                                    sc config SDRSVC start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:2428
                                  • C:\Windows\system32\sc.exe
                                    sc stop wscsvc
                                    4⤵
                                    • Launches sc.exe
                                    PID:3108
                                  • C:\Windows\system32\sc.exe
                                    sc config wscsvc start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:5960
                                  • C:\Windows\system32\sc.exe
                                    sc stop WdiServiceHost
                                    4⤵
                                    • Launches sc.exe
                                    PID:5316
                                  • C:\Windows\system32\sc.exe
                                    sc config WdiServiceHost start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:4448
                                  • C:\Windows\system32\sc.exe
                                    sc stop WdiSystemHost
                                    4⤵
                                    • Launches sc.exe
                                    PID:2804
                                  • C:\Windows\system32\sc.exe
                                    sc config WdiSystemHost start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:4896
                                  • C:\Windows\system32\sc.exe
                                    sc stop InstallService
                                    4⤵
                                    • Launches sc.exe
                                    PID:1752
                                  • C:\Windows\system32\sc.exe
                                    sc config InstallService Start= disabled
                                    4⤵
                                    • Launches sc.exe
                                    PID:1212
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                                2⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5212
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                                2⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5572
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
                                2⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3016
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                                2⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:6072
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
                                2⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4972
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c timeout 1
                                2⤵
                                  PID:6000
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:2128
                                • C:\Windows\EdgeBrowser.exe
                                  "C:\Windows\EdgeBrowser.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2776
                                • C:\Windows\EdgeBrowser.exe
                                  "C:\Windows\EdgeBrowser.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2896
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /Delete /tn NYAN /F
                                    3⤵
                                      PID:5244
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /tn NYAN /tr "C:\Windows\EdgeBrowser.exe" /sc minute /mo 1
                                      3⤵
                                      • Creates scheduled task(s)
                                      PID:812
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 908
                                    2⤵
                                    • Program crash
                                    PID:5428
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3652 -ip 3652
                                  1⤵
                                    PID:380
                                  • C:\Windows\EdgeBrowser.exe
                                    C:\Windows\EdgeBrowser.exe
                                    1⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Checks whether UAC is enabled
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious use of SetThreadContext
                                    • System policy modification
                                    PID:4380
                                    • C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\AdvancedRun.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1376
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2841dd81-cf01-489d-83c7-652a0936f2d0\test.bat"
                                        3⤵
                                          PID:3848
                                          • C:\Windows\system32\sc.exe
                                            sc stop windefend
                                            4⤵
                                            • Launches sc.exe
                                            PID:3196
                                          • C:\Windows\system32\sc.exe
                                            sc config windefend start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:2148
                                          • C:\Windows\system32\sc.exe
                                            sc stop Sense
                                            4⤵
                                            • Launches sc.exe
                                            PID:1424
                                          • C:\Windows\system32\sc.exe
                                            sc config Sense start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:6052
                                          • C:\Windows\system32\sc.exe
                                            sc stop wuauserv
                                            4⤵
                                            • Launches sc.exe
                                            PID:4660
                                          • C:\Windows\system32\sc.exe
                                            sc config wuauserv start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:3712
                                          • C:\Windows\system32\sc.exe
                                            sc stop usosvc
                                            4⤵
                                            • Launches sc.exe
                                            PID:756
                                          • C:\Windows\system32\sc.exe
                                            sc config usosvc start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:3408
                                          • C:\Windows\system32\sc.exe
                                            sc stop WaasMedicSvc
                                            4⤵
                                            • Launches sc.exe
                                            PID:4884
                                          • C:\Windows\system32\sc.exe
                                            sc config WaasMedicSvc start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:3744
                                          • C:\Windows\system32\sc.exe
                                            sc stop SecurityHealthService
                                            4⤵
                                            • Launches sc.exe
                                            PID:4160
                                          • C:\Windows\system32\sc.exe
                                            sc config SecurityHealthService start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:4424
                                          • C:\Windows\system32\sc.exe
                                            sc stop SDRSVC
                                            4⤵
                                            • Launches sc.exe
                                            PID:2428
                                          • C:\Windows\system32\sc.exe
                                            sc config SDRSVC start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:5304
                                          • C:\Windows\system32\sc.exe
                                            sc stop wscsvc
                                            4⤵
                                              PID:3060
                                            • C:\Windows\system32\sc.exe
                                              sc config wscsvc start= disabled
                                              4⤵
                                              • Launches sc.exe
                                              PID:4796
                                            • C:\Windows\system32\sc.exe
                                              sc stop WdiServiceHost
                                              4⤵
                                                PID:4492
                                              • C:\Windows\system32\sc.exe
                                                sc config WdiServiceHost start= disabled
                                                4⤵
                                                • Launches sc.exe
                                                PID:564
                                              • C:\Windows\system32\sc.exe
                                                sc stop WdiSystemHost
                                                4⤵
                                                • Launches sc.exe
                                                PID:3512
                                              • C:\Windows\system32\sc.exe
                                                sc config WdiSystemHost start= disabled
                                                4⤵
                                                • Launches sc.exe
                                                PID:1660
                                              • C:\Windows\system32\sc.exe
                                                sc stop InstallService
                                                4⤵
                                                • Launches sc.exe
                                                PID:1212
                                              • C:\Windows\system32\sc.exe
                                                sc config InstallService Start= disabled
                                                4⤵
                                                • Launches sc.exe
                                                PID:1364
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                                            2⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5300
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                                            2⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5408
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
                                            2⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1504
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
                                            2⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5700
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\ccfP9b0fr9ncIP0szl4Zd59I9922recyNfI908Qw\svchost.exe" -Force
                                            2⤵
                                              PID:5536
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c timeout 1
                                              2⤵
                                                PID:2376
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:3324
                                              • C:\Windows\EdgeBrowser.exe
                                                "C:\Windows\EdgeBrowser.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:5504
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /Delete /tn NYAN /F
                                                  3⤵
                                                    PID:1580
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /tn NYAN /tr "C:\Windows\EdgeBrowser.exe" /sc minute /mo 1
                                                    3⤵
                                                    • Creates scheduled task(s)
                                                    PID:5492
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1604
                                                  2⤵
                                                  • Program crash
                                                  PID:2128
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4380 -ip 4380
                                                1⤵
                                                  PID:5716

                                                Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EdgeBrowser.exe.log

                                                        Filesize

                                                        706B

                                                        MD5

                                                        7119a280abc0c4b5f21a0932887a54ac

                                                        SHA1

                                                        aa369248ea6d293fe56a5ed669e29cd897911f84

                                                        SHA256

                                                        418398bab7542ba692fe00d88d6de06c65f73b9376567c5190a007f7a211c91f

                                                        SHA512

                                                        b11111d017e86445be9c41d2ca4a6e147cf2d8ae31663bb0772e2eaaf3a7a906285ab78a708d9122a29f8aa2519e80b12e050ad4538867e2b5d3edb0fe21039f

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        3d086a433708053f9bf9523e1d87a4e8

                                                        SHA1

                                                        b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                        SHA256

                                                        6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                        SHA512

                                                        931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        baae53960a16dc597dd58f7483d0e244

                                                        SHA1

                                                        1652ebb8d43bdd394477e3ac971164987a8d180f

                                                        SHA256

                                                        9d04961f6061cafe3ecbe37d17e15f49e912c865534770f6c31d72e1ab5c3489

                                                        SHA512

                                                        199027fbd5d8cdb8876b397d625656bc7144019f4463655ccd2859099fb581918cc7fa91e08eb58526e3676a0d9e8d2400994f141e89d4c1aae6fe68f945de0b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        f3ff369ed4627592f38e9d8b56b9860e

                                                        SHA1

                                                        9bca1801767c963f031a3a086629da99e06afbc7

                                                        SHA256

                                                        35ac065038538d4ab322bf6d557fb135d1b459ebd151ec50cf6d6166adbf6bb0

                                                        SHA512

                                                        9054088b3a1393483244325d7cc56939df101b0a279f1e08b4e30db8397f38fbb039458ff23bc33dc11d460445ea8a57be760c06962eed29ef6604fbe05edeac

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        057819fcfdbf14ab966a39eedafbde4f

                                                        SHA1

                                                        e20c61d2833f4170c91384f36170c239d3c548ea

                                                        SHA256

                                                        65d033459b7c49b191298a85776042837322039bbfed517cca7740dcd36f4dfb

                                                        SHA512

                                                        920ecc541444615127d57074dfcee2e16d7b717a1de53dd6b8ccd8a608d904a4dd81bb392258b64d895dae7e6225339ffbafeecfe5276b7276f577232c011221

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        329952f834379bf2875b4db251d912f3

                                                        SHA1

                                                        27b4ec4d29d10adb409741320fefe61a3218b5c4

                                                        SHA256

                                                        8dd5f3fe1a41b95d55dc8b6dcd14dd9fdfbc156d6fc237dceced77c4b3fd1dbd

                                                        SHA512

                                                        6a4ab97add77f5aabf3ccf03804cdfd30c0dfef3df085819495cb1c6c919f3b3e5627cfe4d0edb765330c8b8280f125f0596a606dc017906f5ae486de80b3f3b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        2b61613deb3c401d5958654afbf238e4

                                                        SHA1

                                                        ffa7f35252df7925186f28cd37d0ffb9167ff1ee

                                                        SHA256

                                                        96dad8750fd7a590a6a4f5cb243ab55e9ea4d9c46bbe797ef2bac168e78f27ff

                                                        SHA512

                                                        d05f89130a2fbcb5d8ab63eea324edc35cd10a40976b8d0caa0e3c1bf011ac45d45bb4cf8a07fee956cf30550afabee860a5a0299324b65aacf46b787f85f87e

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        76283a739a91052d8e15b06e224886ab

                                                        SHA1

                                                        e3f575d73ce1ffd954097a5ec05308dbc4c77f26

                                                        SHA256

                                                        ffdb32151113d42f976eda98773365b61dcce26f909652bf102c3f4177e087b5

                                                        SHA512

                                                        f853b0d923ef85a2402e034bc77c642de74737ec6f7a09f26d2ee25cb8ef5774e9676c0300b839395690e0ebaf75e7903ade967c07e50662599a390503c66113

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        ee8e51193bb9bd7102bda5424230d274

                                                        SHA1

                                                        091b226ca758ec2406ccb7b1fee35f52535ded7d

                                                        SHA256

                                                        2cf262e516568164690da14e3a0ef1ef8d0d9748185eef3a1443969c5d8451c1

                                                        SHA512

                                                        562c25b7a1e16e62acfc30bb5c8b592a5ee9ce6db7add2dbc91a95bf499abf1adb2cbd9b1116a82faa18b689c12adc040fbc9a320308051170629c6f196058f0

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        33ca929e023719ea658483a8003440f3

                                                        SHA1

                                                        ea074ddf22c609d268937dfbf9890805b998d1f0

                                                        SHA256

                                                        e070605c605d04fe98743fbb7910808cb9c6653e7d0e644ef7aa7c2959e6685b

                                                        SHA512

                                                        6e5d11cd83e6f1df12793b648e66b0e457067f83e2893251022c6d3d31521650a9f0d2c4cf3303f142c5cb9597af97fefe7d9738d8d9863957f26105951bcab7

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        73627b3a4a23005b8d8a4f44ee956d09

                                                        SHA1

                                                        d9f48698f83851d6d59cb5db1b2e8d05588125e8

                                                        SHA256

                                                        825e543611c2dc08f89f4eda465a9df84d050b9594bb2ff745e5cfbd8452626a

                                                        SHA512

                                                        3c574e508aaa8affd25520d1e0dfc09e0dc49401f63bcf82f96c9c4cedc7152431679aef9be1f820dfdf6774d9a364bfee7c4c7b413edd77b128126ea4ff291a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        b1ee8842dc4d0a87f5e02577a193efde

                                                        SHA1

                                                        cbb85515032a6729d728341e5093b81b7b79fb9c

                                                        SHA256

                                                        72493c1ce10829c803abd37bd10d628722e80014a5c31c6b0dfa050a99b9fbd7

                                                        SHA512

                                                        d2360f52adf4af4c2862d35a045dc7395baba5dd9357d8ef2d67458604a9bbf18336bcaa2cce92b5a02598ac21cda78377e78b5b4a9b9734cf2f4bc1e4aad4ae

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        6a93937d54e9fd95fb056f6d64d075ed

                                                        SHA1

                                                        8502f83f952b07a1fdf0e6d70fb9808ebb14195d

                                                        SHA256

                                                        0833790b15fb1c86c4263ea85368896b71d58ad6f6497cc6ac97b52b20114c10

                                                        SHA512

                                                        85e0171b694c18e8bd44c77fdb441f34f3c535fff5c0ca1925660957188369c8b88c6740c2e5b785cd39d990f5f8e42102736dae03acf158f4657ff52f519beb

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        3066c5fda9cb7ef23c35380b45f3a583

                                                        SHA1

                                                        ffc39b2adad1b8456d4fc3f0562aa4fd359bb7e0

                                                        SHA256

                                                        ed1fb092e9ad637e4a9bbb4ffb0ef9d9f420752ef2d0593bd3eb2ef4bc731720

                                                        SHA512

                                                        c726decb49b1fb0d55909f4b1d395da8a1a7a1982a044bcbedb21521247e33ef55632527b8585dd210fb0bd2198dd5c37c63f579d0ba8153b9a9b750d3ca6dc0

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        3b763c0f171168322352b7c2d44f0363

                                                        SHA1

                                                        a462f3abb60f9d9183261a7a8b561841fa0d5acc

                                                        SHA256

                                                        50f12d1c7f69b71bac2d15bc83e87f94e1d2f8539df2aad2b45c84ef4d1c0693

                                                        SHA512

                                                        a8ed2a2419d723ac97fc442351e8cfde2f528f9f80273fe29d21c21c166d31fb083d7da60c93dbf804ae23ee57e50c13bd78e7056250506fa4adaf28c7ba6342

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        ef0ff7fab3698e36f71ff2e5104a0cbb

                                                        SHA1

                                                        b5f931fe2ab8c7f52cdc72c94dd2bfceab266845

                                                        SHA256

                                                        4ac50ebcf55d17aba4e6e8a2ef02a518b65400940fcf472d8f9ff7c83cde42c3

                                                        SHA512

                                                        a4fbb43a7fc248ea358d8b0b93dc84629ec0716549da8e91e109e17fd4a2800be9f7f14f83c052dbaf8f881f76f83dc9737f8e6116845fb656c37b659dd6ef59

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        764B

                                                        MD5

                                                        5cc6f319006e65e83cf5a83452ef1462

                                                        SHA1

                                                        deab3bf72efa0c849b5dfd2b384e3889001d0178

                                                        SHA256

                                                        73669629d189346d53326de4715f65fdcd571bfb3681f97c78f195c2869b782e

                                                        SHA512

                                                        5042589a9d5d8b7b9fc8319bc989d0b0353b54877361e663d5301cca69f5d5683db7f90ec7218a51de35f4f61d4cf283feef634a8e296b9a93c8cd5c51650129

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        552B

                                                        MD5

                                                        1a3c8348583151adec3f6b7c3669c886

                                                        SHA1

                                                        9d9ace9ebb4fe417bbc72f5e5a6c4441d8746c60

                                                        SHA256

                                                        56bbea00d94ce1668accae9d334c775b324d6349cebde9439c4d03632bae825e

                                                        SHA512

                                                        9ed0f7a06acbdff7ef7dceb0f4debb7bd5237107901fff074e3a77cb417ba89a3d0e8dfaa2ad86bc5e38f2b587f043872bfcdfc123c938c6bcb6ef5e65ea8eb6

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        18KB

                                                        MD5

                                                        bd76416a086fedc4c0e2abaaf74525fb

                                                        SHA1

                                                        27992c39e25de4d7d49a4762a25ced1160bcd521

                                                        SHA256

                                                        bc8bcf7709b2b5c4a0b32047c2e1be3f7b2492ac892ea75745c84cf999ffb8c6

                                                        SHA512

                                                        2fe2afdace104e4328b479909459dc248484537c8af59b57201986562f353c99a7dac0e4e68bdccc85fd0e26c547f49e30a8b40ea7e970fd88077c20f48716a1

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        64B

                                                        MD5

                                                        74d7095da2833bb0dff8c00536ca95c1

                                                        SHA1

                                                        8ba1052306aa360adcaee670666e2c42044b0018

                                                        SHA256

                                                        9f088611b35f28d77a330c0aa545269a25eecc9411566cd33fa2f7d72a671244

                                                        SHA512

                                                        b82a5b5fdd7703740305514f09adbdb22caab6d0b36e49867fa470932f0ef11ad78c4defdcb0342642202ec432ec281864dd3096e82ddf84a8db8895620e751b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        8c4217af9f07bded779a75b814d05119

                                                        SHA1

                                                        fa8c23e1a873815a740c31487b058fac7efdddc8

                                                        SHA256

                                                        5c3c39026f031c34978cf4ca3a32b568b54f8103ceda5580969537b196d21671

                                                        SHA512

                                                        ca8cd0eea48f541160943cb0379c3c71de9b9425769299ad0c17daa101b24882b05d472ab93d9e025968ab91ea038561223ecc506dd53a42bdf60a185c38b786

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        724B

                                                        MD5

                                                        2002a1cb17c93d10191f253e2f29b73b

                                                        SHA1

                                                        3befbcd3100b5c64e5171e6837389c24dc8ed8f0

                                                        SHA256

                                                        719bf57a58c0ce85fdfce8f61ea17c234f4765792b37d070d3bbb56604c75866

                                                        SHA512

                                                        04faf60afc929a0c0ab86c2bc08a9f3365b7706b615b3136d9abf7be04f18477a5d82d34cfd0622cc9dfe42773ba57a02a964eb65aa962b515e5a68f46605018

                                                      • C:\Users\Admin\AppData\Local\Temp\3a8d1037-c218-4468-b049-38d039afce41\test.bat

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        b2a5ef7d334bdf866113c6f4f9036aae

                                                        SHA1

                                                        f9027f2827b35840487efd04e818121b5a8541e0

                                                        SHA256

                                                        27426aa52448e564b5b9dff2dbe62037992ada8336a8e36560cee7a94930c45e

                                                        SHA512

                                                        8ed39ed39e03fa6d4e49167e8ca4823e47a221294945c141b241cfd1eb7d20314a15608da3fafc3c258ae2cfc535d3e5925b56caceee87acfb7d4831d267189e

                                                      • C:\Users\Admin\AppData\Local\Temp\8ba77dff-9026-4926-9458-42a1833160cf\AdvancedRun.exe

                                                        Filesize

                                                        88KB

                                                        MD5

                                                        17fc12902f4769af3a9271eb4e2dacce

                                                        SHA1

                                                        9a4a1581cc3971579574f837e110f3bd6d529dab

                                                        SHA256

                                                        29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                        SHA512

                                                        036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p4tf1zle.i5d.ps1

                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe

                                                        Filesize

                                                        2.0MB

                                                        MD5

                                                        730e216d275e35cbb81d3f1b709b228b

                                                        SHA1

                                                        21b92b5eb008a4eebd3f517b1716bc0851c76721

                                                        SHA256

                                                        80502885722e2b1e083a55428641eb89be7c40b7aef5eb5c64860c8063238d19

                                                        SHA512

                                                        02fc645558067f18f43820f79b41ec19d060c8b533cd87fa090693150ca8342efed59d9e6dd75da74c2e3184e330d6ab5fb97b83b4a712dc4507ca76da9a2a88

                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe

                                                        Filesize

                                                        1.4MB

                                                        MD5

                                                        75943786884d898bcd0b33357bd0d4f0

                                                        SHA1

                                                        3224fea4ab0d7d802557d40a7397f62851ace5b2

                                                        SHA256

                                                        3f4c6c332c7663cb00a26ebf7a96a86158f860c05aab166b14a322cf2756249f

                                                        SHA512

                                                        4c260f01ce462b7447b466fdd29b0793fdcb87c3767b1606e15465c02b9bda07583cbb4d582e4410a86931854a4ff2dc6822017a2ebebf8615dc89ea85971e5e

                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe

                                                        Filesize

                                                        1.7MB

                                                        MD5

                                                        715f46ac730dde8d1439d6b78da3050c

                                                        SHA1

                                                        ea95023b269af1e801286d341ac5499ea34cfd6f

                                                        SHA256

                                                        c088f887a120770807cc09e3bad4da8a095f53f792bffa3ed751b5dc1c9b9347

                                                        SHA512

                                                        54821dcc99b4ec5183861ee0ad8ac358d60f29b4c10877df8992e40bc9577cc220ca3f580ed232c232f504aa2127992d4d01703dad5597944baf83c954c4718e

                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cJUfE9Xd0b5WLb2c096f785mW2dK8e551jRc4vH8OT8by7.exe

                                                        Filesize

                                                        939KB

                                                        MD5

                                                        4f70e8af9ae9f628b8a1b4ddd76d911c

                                                        SHA1

                                                        505ea25565d741edc020925ead156e6fd7d7487f

                                                        SHA256

                                                        555e6e85bccacb4db1cde30167bfdca8bcc16392e19031e943cc864d07f8aca3

                                                        SHA512

                                                        8309c77f724c8e8b81d6486488ca7c01e80c1826c5a50022ac788ddaa31d8b5f9f13b00b480aa7acc1f2595703d6969da681b647855335fdc4ae26eaf7591c81

                                                      • C:\Windows\EdgeBrowser.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        81bda5dffbd964c6199ff8f9fb62c386

                                                        SHA1

                                                        ea645805a8e9872304e402832b6fbfc96bdb660a

                                                        SHA256

                                                        89c860c035a86b1e1c1af540eaaabb15db50a15c70086b2d986a159c32d1e918

                                                        SHA512

                                                        bb9baaac4c57a703bc0f3e7307ed4596a6d10ea90a5f6fd48e06d3a015447aa644b9f8ab5e0496a3cb8a738fd6bc72c3158c4203530a4342b555473197bc71f1

                                                      • C:\Windows\EdgeBrowser.exe

                                                        Filesize

                                                        28KB

                                                        MD5

                                                        cbca9027b0f391f421bc236ca417848c

                                                        SHA1

                                                        0d1e83363f5c030c83a746d74a609778e05432a8

                                                        SHA256

                                                        7d02fbfd3d9b209f24bdd1727a979c1bacf83f5d12a2b618e05c36ba40ff826f

                                                        SHA512

                                                        48b6b28d4aa7004e047e62d2a37c5ec0f73f8e6546e21913b7627d4daf15e6556730216bee63a8974afa2666494f7d235ef8b9be64dce7aeee6e444757acb46f

                                                      • C:\Windows\EdgeBrowser.exe

                                                        Filesize

                                                        2.8MB

                                                        MD5

                                                        796ed4b0db9b3d50149b39c35c97fb22

                                                        SHA1

                                                        154fde51c43d3a8b8f1b96df04f3e97fe4c922a6

                                                        SHA256

                                                        37db478cd1a50883e179c601987b3a5171823aaa9d04063817fa7af57723ffb7

                                                        SHA512

                                                        762989d2993cc2431b50ae9a2847cc3b16bce41c15da9a974dd90c66884ac28b32698edbf9d13b948d7b1f22919278b43e4448710dda2b2489b509bd6ecf00c7

                                                      • memory/320-106-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/320-111-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/552-122-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/552-99-0x0000000004980000-0x0000000004990000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/552-105-0x0000000004980000-0x0000000004990000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/868-40-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/868-112-0x0000000006820000-0x0000000006830000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1080-210-0x000000006F8A0000-0x000000006F8EC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/1080-53-0x0000000005150000-0x0000000005160000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1080-51-0x0000000005150000-0x0000000005160000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1080-77-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/1360-54-0x0000000005010000-0x0000000005020000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1360-98-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/1360-66-0x0000000005010000-0x0000000005020000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1376-151-0x0000000005E40000-0x0000000005E5E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/1376-157-0x000000007EF40000-0x000000007EF50000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1376-209-0x0000000007190000-0x00000000071AA000-memory.dmp

                                                        Filesize

                                                        104KB

                                                      • memory/1376-41-0x0000000002520000-0x0000000002530000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1376-156-0x000000006F8A0000-0x000000006F8EC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/1376-170-0x0000000002520000-0x0000000002530000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1376-171-0x0000000002520000-0x0000000002530000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/1376-36-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/1376-42-0x0000000002520000-0x0000000002530000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2320-7-0x00000000067E0000-0x0000000006D84000-memory.dmp

                                                        Filesize

                                                        5.6MB

                                                      • memory/2320-190-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/2320-5-0x00000000048C0000-0x00000000048DE000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/2320-6-0x0000000006220000-0x0000000006230000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2320-4-0x0000000004840000-0x00000000048C0000-memory.dmp

                                                        Filesize

                                                        512KB

                                                      • memory/2320-195-0x0000000006220000-0x0000000006230000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2320-3-0x0000000004D20000-0x0000000004D96000-memory.dmp

                                                        Filesize

                                                        472KB

                                                      • memory/2320-0-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/2320-2-0x0000000004DC0000-0x0000000004E5C000-memory.dmp

                                                        Filesize

                                                        624KB

                                                      • memory/2320-8-0x0000000006230000-0x00000000062C2000-memory.dmp

                                                        Filesize

                                                        584KB

                                                      • memory/2320-49-0x0000000007220000-0x000000000722A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/2320-1-0x00000000000D0000-0x00000000003B0000-memory.dmp

                                                        Filesize

                                                        2.9MB

                                                      • memory/2896-152-0x00000000061C0000-0x000000000620C000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2896-45-0x0000000004D40000-0x0000000004D62000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/2896-23-0x0000000000A80000-0x0000000000AB6000-memory.dmp

                                                        Filesize

                                                        216KB

                                                      • memory/2896-26-0x0000000004900000-0x0000000004910000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2896-25-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/2896-28-0x0000000004900000-0x0000000004910000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2896-27-0x0000000004F40000-0x0000000005568000-memory.dmp

                                                        Filesize

                                                        6.2MB

                                                      • memory/2896-193-0x0000000004900000-0x0000000004910000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2896-191-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/2896-50-0x0000000005570000-0x00000000055D6000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/2896-52-0x00000000055E0000-0x0000000005646000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/2896-158-0x000000006F8A0000-0x000000006F8EC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2896-55-0x0000000005650000-0x00000000059A4000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/3616-205-0x0000000008070000-0x00000000086EA000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/3616-153-0x0000000007670000-0x00000000076A2000-memory.dmp

                                                        Filesize

                                                        200KB

                                                      • memory/3616-43-0x0000000005310000-0x0000000005320000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3616-75-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/3616-155-0x000000006F8A0000-0x000000006F8EC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/3616-172-0x00000000076C0000-0x0000000007763000-memory.dmp

                                                        Filesize

                                                        652KB

                                                      • memory/3616-44-0x0000000005310000-0x0000000005320000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/3616-169-0x0000000007650000-0x000000000766E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/3616-154-0x000000007FC90000-0x000000007FCA0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/4440-47-0x00000000025C0000-0x00000000025D0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/4440-48-0x00000000025C0000-0x00000000025D0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/4440-76-0x00000000745C0000-0x0000000074D70000-memory.dmp

                                                        Filesize

                                                        7.7MB

                                                      • memory/4440-194-0x000000006F8A0000-0x000000006F8EC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/4440-206-0x000000007F420000-0x000000007F430000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/4440-208-0x00000000025C0000-0x00000000025D0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/4440-207-0x00000000025C0000-0x00000000025D0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/5432-304-0x0000000000400000-0x000000000041A000-memory.dmp

                                                        Filesize

                                                        104KB