Overview

overview

8

Static

static

1

URLScan

urlscan

1

http://yotube.com

windows11-21h2-x64

Analysis

  • max time kernel
    103s
  • max time network
    224s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/03/2024, 16:34

Sharing

Copy URL Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    http://yotube.com

Score
8/10
persistenceransomware

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 17 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\0377699451b0474f90c77fe0ebb680e4 /t 3228 /p 3224
    1⤵
      PID:1488
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://yotube.com
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb11a69758,0x7ffb11a69768,0x7ffb11a69778
        2⤵
          PID:1376
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1888,i,212661482168618987,9721156099793315627,131072 /prefetch:2
          2⤵
            PID:1904
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=1888,i,212661482168618987,9721156099793315627,131072 /prefetch:8
            2⤵
              PID:2932
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1888,i,212661482168618987,9721156099793315627,131072 /prefetch:8
              2⤵
                PID:4388
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1888,i,212661482168618987,9721156099793315627,131072 /prefetch:1
                2⤵
                  PID:2040
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1888,i,212661482168618987,9721156099793315627,131072 /prefetch:1
                  2⤵
                    PID:1788
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                  1⤵
                    PID:1652
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Sets desktop wallpaper using registry
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:3116
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                      2⤵
                        PID:3516
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb17813cb8,0x7ffb17813cc8,0x7ffb17813cd8
                          3⤵
                            PID:2200
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
                            3⤵
                              PID:1524
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 /prefetch:3
                              3⤵
                                PID:2900
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
                                3⤵
                                  PID:4012
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
                                  3⤵
                                    PID:772
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
                                    3⤵
                                      PID:3732
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
                                      3⤵
                                        PID:1384
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
                                        3⤵
                                          PID:3720
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
                                          3⤵
                                            PID:5504
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
                                            3⤵
                                              PID:5516
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
                                              3⤵
                                                PID:6128
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                                                3⤵
                                                  PID:4984
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                                                  3⤵
                                                    PID:5904
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
                                                    3⤵
                                                      PID:3984
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                                                      3⤵
                                                        PID:3976
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                                                        3⤵
                                                          PID:5272
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4932 /prefetch:8
                                                          3⤵
                                                            PID:5352
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4904 /prefetch:8
                                                            3⤵
                                                              PID:4264
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                                              3⤵
                                                                PID:6096
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
                                                                3⤵
                                                                  PID:4884
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
                                                                  3⤵
                                                                    PID:6044
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                                                    3⤵
                                                                      PID:3976
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1836,7022186065669576162,5289748063394346639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
                                                                      3⤵
                                                                        PID:3420
                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\000.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\000.exe"
                                                                      2⤵
                                                                        PID:3408
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
                                                                          3⤵
                                                                            PID:5824
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /f /im explorer.exe
                                                                              4⤵
                                                                              • Kills process with taskkill
                                                                              PID:5724
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /f /im taskmgr.exe
                                                                              4⤵
                                                                              • Kills process with taskkill
                                                                              PID:2720
                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                              wmic useraccount where name='Admin' set FullName='UR NEXT'
                                                                              4⤵
                                                                                PID:2688
                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                wmic useraccount where name='Admin' rename 'UR NEXT'
                                                                                4⤵
                                                                                  PID:3108
                                                                                • C:\Windows\SysWOW64\shutdown.exe
                                                                                  shutdown /f /r /t 0
                                                                                  4⤵
                                                                                    PID:4856
                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                              1⤵
                                                                                PID:4644
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2108
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                1⤵
                                                                                • Enumerates system info in registry
                                                                                • Modifies Internet Explorer settings
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:3252
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 3252 -s 4352
                                                                                  2⤵
                                                                                    PID:4100
                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                  1⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1428
                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                  1⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4028
                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                  1⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3556
                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                  1⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:788
                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                  1⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2712
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                  1⤵
                                                                                    PID:4872
                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                    1⤵
                                                                                    • Enumerates system info in registry
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4144
                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                    1⤵
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:412
                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                    1⤵
                                                                                      PID:3428
                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                      1⤵
                                                                                        PID:4776
                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                        1⤵
                                                                                          PID:4824
                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                          1⤵
                                                                                            PID:4236
                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                            1⤵
                                                                                              PID:952
                                                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                              1⤵
                                                                                                PID:1796
                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                1⤵
                                                                                                  PID:3556
                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                  1⤵
                                                                                                    PID:4196
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:5248
                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:5368
                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                        1⤵
                                                                                                          PID:5460
                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                          1⤵
                                                                                                            PID:3404
                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                            1⤵
                                                                                                              PID:3600
                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                              1⤵
                                                                                                                PID:3804
                                                                                                              • C:\Windows\system32\LogonUI.exe
                                                                                                                "LogonUI.exe" /flags:0x4 /state0:0xa38fb055 /state1:0x41c64e6d
                                                                                                                1⤵
                                                                                                                  PID:5816

                                                                                                                Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        3da2daaa054f9613dbf41320fbc23a17

                                                                                                                        SHA1

                                                                                                                        729d9105124012e5befb656125605d34e91869cc

                                                                                                                        SHA256

                                                                                                                        4b1785fa8524b812f852b16ccb989783b15f29a6cb87487f7f446e0da66bad6b

                                                                                                                        SHA512

                                                                                                                        1c75782fd7bb0adc844e448e388001a02717fd653148c6b7c9bb188894265466cdc67ff2d5013f180522e7959a7dc04f8b740dd063bfec03330039b0ee167ef4

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        16f73c191db7092fac52f2a7e265218e

                                                                                                                        SHA1

                                                                                                                        fead00927e10fe998198963deff58b21c4b95cc6

                                                                                                                        SHA256

                                                                                                                        25e6df17bfb29ff88da0cb20d128654fa1cab735fc7d33c9eb70b01304a8a066

                                                                                                                        SHA512

                                                                                                                        ff995a2978f3266eb44d8975e76a7a550cd2c2482726d0ce281bd621068133c6ff64e260b752e2c62d69a6bf6685329734ef143f40156a7fa2aa4a7df95ddc17

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        3f82b576def5f54873894dbefc275a3a

                                                                                                                        SHA1

                                                                                                                        42a0ef54141e5e405fcbaef25d31f5fec454bb99

                                                                                                                        SHA256

                                                                                                                        59c0a84d8f25af3165c9ae2a504aece2228ee50b2a3b83999a17d87f521da6f1

                                                                                                                        SHA512

                                                                                                                        1a9eab4e0acab55529c8f6d72a51f67d8e049ad0ad3acd21b4cd3559e24ef69751fe4f909facab3b0f696bed63ef671a41312c1157e1526a4cc23b2556663367

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        ee52dc770c64b0d4817eb1855c2509d5

                                                                                                                        SHA1

                                                                                                                        c805638c8832e8cf4991a5dc2b83d27093635c53

                                                                                                                        SHA256

                                                                                                                        0a2e9b2ea5344e298e7e2ba689683da0ac6f7b53783a42fae2d5124716a7b780

                                                                                                                        SHA512

                                                                                                                        a6428e3aa16838ad8b599302b9c639e30fd52214942b7f20aa069c8379c70aa7270dd82412def5cbd543d054a786f00a5e63fdf082ae802429a77674aacdbd2c

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        8f996534900b4e25b4297db7e1debdbe

                                                                                                                        SHA1

                                                                                                                        0acaf4e14b03373db963872c8617ef25ca228c78

                                                                                                                        SHA256

                                                                                                                        327e4847fb7c118495791da485111afec50017696664c5718b61248518df834c

                                                                                                                        SHA512

                                                                                                                        bc5383056eabf4d45e5d6411bf482582ff3c808df534ff4bf77ccb6279f0f9f169f31a5ff9e490ba235b45fc09c934594f08efb8f9cf457b1f26e4f6beff1f89

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        74e0152d83f4b0a79ae2756186e805fa

                                                                                                                        SHA1

                                                                                                                        c53e33ec7d0f1f3cabe82177afa85d0f23984d1c

                                                                                                                        SHA256

                                                                                                                        f1dcc2e881d0b93146489fe7fbc0b782df298ca1db5087f3338fb33dabe08a13

                                                                                                                        SHA512

                                                                                                                        c085cfffa165d567f98ae99d1206c315231dc41f5cc83491476ea57e9b7c7366af7d82caaa0943f57ee0b7566d94a0e6ba237dfe28a750680b10e9e95dfbff04

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        130KB

                                                                                                                        MD5

                                                                                                                        e5c180c5f7b93fb9f48a31b4e93c5b72

                                                                                                                        SHA1

                                                                                                                        88ca6cad978313b50fbb978e8be3b3ef9a5cb004

                                                                                                                        SHA256

                                                                                                                        b6ec2288bf387d658c57e8937511561b490c546bc26b34bca2846c62a77cd682

                                                                                                                        SHA512

                                                                                                                        2cce6f88bcfc99072435a6db3d63336077c534a00a1c6f01b4f0a98afd3eb66c7087813b97d4b48907b265f45ec674894be4522b9d65366c2829e94f5570bf21

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        130KB

                                                                                                                        MD5

                                                                                                                        cd37e2d614afd139e849eafa0fa47b27

                                                                                                                        SHA1

                                                                                                                        268c5ee882ad863ea29fa9cbefa04a0690ef3599

                                                                                                                        SHA256

                                                                                                                        51e2f75bbcee72289f188b1237694ddf4829fcbb026c52331882469cbfc9b985

                                                                                                                        SHA512

                                                                                                                        ef0acfa5db801ddbea63bef799c04a9a79a9aca9eba9df956e70cf065efd91796bfd4540769a61acb32d5852ef50b0a7f728a85f3a406be0951cd4963957a5ae

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                        Filesize

                                                                                                                        264KB

                                                                                                                        MD5

                                                                                                                        64e3ade962c2bf76aa4990f983ee9986

                                                                                                                        SHA1

                                                                                                                        2525b68574ce15300d8acfacd9c14f2a23c7ab31

                                                                                                                        SHA256

                                                                                                                        1069f3da040ab8db72abf02a6f13c00cc04a89ea76124238d47167e0af4dc97e

                                                                                                                        SHA512

                                                                                                                        ebf5ae5f4ed159f394086ef7579864131328b4fad0c3602de2d54893e5daa7535b14f2cd068904feadeeb450e3f02c9f0357999386bf0a5f2a85faf69138c515

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                        Filesize

                                                                                                                        152B

                                                                                                                        MD5

                                                                                                                        88e9aaca62aa2aed293699f139d7e7e1

                                                                                                                        SHA1

                                                                                                                        09d9ccfbdff9680366291d5d1bc311b0b56a05e9

                                                                                                                        SHA256

                                                                                                                        27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

                                                                                                                        SHA512

                                                                                                                        d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                        Filesize

                                                                                                                        152B

                                                                                                                        MD5

                                                                                                                        341f6b71eb8fcb1e52a749a673b2819c

                                                                                                                        SHA1

                                                                                                                        6c81b6acb3ce5f64180cb58a6aae927b882f4109

                                                                                                                        SHA256

                                                                                                                        57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

                                                                                                                        SHA512

                                                                                                                        57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                        Filesize

                                                                                                                        3KB

                                                                                                                        MD5

                                                                                                                        a704e46959714fd014c9919baa177f73

                                                                                                                        SHA1

                                                                                                                        b4b7f194e6be5f0e7cfcd7136a21db22f58db0af

                                                                                                                        SHA256

                                                                                                                        d77241e60e8849b82aaad17f0543cffd65ee60dfeee5c7309b14b3b70c2b1419

                                                                                                                        SHA512

                                                                                                                        e287b5f0c0d8b85edb26a4c14b0fb32ca1f0f7059b65e2d034a7844a1fe9e8f98eb504ddbfb74f18bf5a07749f281cc572fa35a8e42a61debe9bf751b2c4ebd9

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                        Filesize

                                                                                                                        111B

                                                                                                                        MD5

                                                                                                                        807419ca9a4734feaf8d8563a003b048

                                                                                                                        SHA1

                                                                                                                        a723c7d60a65886ffa068711f1e900ccc85922a6

                                                                                                                        SHA256

                                                                                                                        aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                                                                                                        SHA512

                                                                                                                        f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                        Filesize

                                                                                                                        853B

                                                                                                                        MD5

                                                                                                                        0e8e6c2eb9e30d6f7309d10ff5b2cade

                                                                                                                        SHA1

                                                                                                                        5fccf72d6f06c4a63a35c00c58c4690824f77df7

                                                                                                                        SHA256

                                                                                                                        5e67b8e1951010d456c79b3310dfc4ca6efc563375561be8ef4edd9d6e4185c1

                                                                                                                        SHA512

                                                                                                                        18237ea1b6a744349b47b41aec610e3cff4883ecf6a3a1246841ade81a23e39c6f9bd8897f975632ff986e0b58047e97578926280ee5e9242af41a099745f9dd

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        e9c4f26f76176138f74f90b9396a2721

                                                                                                                        SHA1

                                                                                                                        b393d8cc684f7348da3b61625449233ee472c156

                                                                                                                        SHA256

                                                                                                                        11c55ad7422dd00adb93bf2bc24265fbb2b6c1fa00ad4c74efbcfda0eb035c58

                                                                                                                        SHA512

                                                                                                                        882ac925d9b26cb96739ec99639346c8ba9117cd469048e9ee2c5a26d35180ba6e1f64b976e2d6a10f69babf66a0faeec8fd4b21b9f55fc2f31e872e9604af70

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        3d9899b9595813ba87265d89573909e3

                                                                                                                        SHA1

                                                                                                                        c7db00b16e512d4d71b1eaf61960c2296ac7d7dc

                                                                                                                        SHA256

                                                                                                                        336fa4fb0f6e9f022083a17b9c075f18c72535c2f6e745065833deba33eb737c

                                                                                                                        SHA512

                                                                                                                        e1c39cdb0f7104f1ed229dd80faa99e2681c2bdd7587b25541ae7a7ba71d52ef71f3434676a8ca019a2d3a8933a708c4ae655585c5affac90c36c5a62abb2b23

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        5KB

                                                                                                                        MD5

                                                                                                                        7dfba548867ccd61178c978d190215bd

                                                                                                                        SHA1

                                                                                                                        cf8b2c8dbc003c669fcd038d7a515b8b8e55d36d

                                                                                                                        SHA256

                                                                                                                        962ca7ac86cf61c0cd0b47044e0e42c5fe43d7c39b9b8cd4ab17d22a8f077a45

                                                                                                                        SHA512

                                                                                                                        031911407a451b8c825186aead2ba6ea3f91c1c0a403d54b2953c7c0c044e64a55bea3f8dc669afeadeae16d0b3f0eb10d513daa3e97cf2a206ce6de423739ed

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        5KB

                                                                                                                        MD5

                                                                                                                        a299ce6fbd1a7ae0d5b1b5718c1f1791

                                                                                                                        SHA1

                                                                                                                        f95a7081723649426c48459fa306dcaada82e719

                                                                                                                        SHA256

                                                                                                                        1ef0e6807b6b5ae0352f1bea9a000eb27f9f3a700017705a20d7c1bbcffe8923

                                                                                                                        SHA512

                                                                                                                        75703335afb6601037a5a748d5c45980ab92412d3330d89d9f9045106f7aa5d12cb0be90ef2b59a48c1e6f12ac14b2b15345e30b596efe429730485f44fe55ec

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        5c42ded82395c3e405e007e13aab5783

                                                                                                                        SHA1

                                                                                                                        6c6023bed15f48d3430a156a6141c893a50bc5fd

                                                                                                                        SHA256

                                                                                                                        e9479d67a0156611d9059c1e982065bcc78e42fff57b0eb663950b63ccea6eb2

                                                                                                                        SHA512

                                                                                                                        c4ab4223ac5550ae1132a6b48bc41f8fbc668181e75c4f796443d7b9cfb9a52b418227422239f0ee5ba2e82fef580bdc44df6dc14b1aa097eae3fb1034eeaf06

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        4dec6d22b4ab371de8a64442d2a9a81a

                                                                                                                        SHA1

                                                                                                                        06bada3708633ec70f0e92e04a6c57d9ca703eb1

                                                                                                                        SHA256

                                                                                                                        7f5371241f8f9d3c5b9431194735334668dc7eaefe7a16b916510382f8e967b1

                                                                                                                        SHA512

                                                                                                                        585995a0e6879f34fa69f91dac17bf32b4f7d4181c4fed02f442bd57b792f55226a369707aba48d1fb33a9f22556c548420f173e0df87d9220fc72ab4147dbb7

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                        Filesize

                                                                                                                        705B

                                                                                                                        MD5

                                                                                                                        1ce1d5240d40ec10ad4b5ead20f6f288

                                                                                                                        SHA1

                                                                                                                        79015f72c6476f18049d0b20c58fe1c6939136e1

                                                                                                                        SHA256

                                                                                                                        def13c44035e72e3023023af29cbc22f50f84327fa973acff1fd7d78279d8472

                                                                                                                        SHA512

                                                                                                                        a7e7302f4422b721c1040681f30ea374285617ef69ddc64681e5c62b48f07d834d8f70312e23bd01bd42e95a1e02f4f5cb810d11ed7355eec54248b28880beb2

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a5296.TMP
                                                                                                                        Filesize

                                                                                                                        370B

                                                                                                                        MD5

                                                                                                                        e6d685ca85fc9096fea4b6ed1b74f339

                                                                                                                        SHA1

                                                                                                                        303cb9f00bc9073c8cceefb0c5a323c94096c86f

                                                                                                                        SHA256

                                                                                                                        33e5af0dd7cd38290fe8fb495a805666325f6bef08351fc5ebfbbe62f6c1583b

                                                                                                                        SHA512

                                                                                                                        264aa10cb6ad56127c3eab294f9a4d1150f4ac722e2ac28393cd758d022e24dc8c9cd3222d29a365f5a0ae2ce4c5aa3162243b9b66d396b8cda8077763e53c77

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                        Filesize

                                                                                                                        16B

                                                                                                                        MD5

                                                                                                                        206702161f94c5cd39fadd03f4014d98

                                                                                                                        SHA1

                                                                                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                        SHA256

                                                                                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                        SHA512

                                                                                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                        Filesize

                                                                                                                        16B

                                                                                                                        MD5

                                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                                        SHA1

                                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                        SHA256

                                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                        SHA512

                                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        11KB

                                                                                                                        MD5

                                                                                                                        30f354ad238d561c9c49cf2aa5674c5d

                                                                                                                        SHA1

                                                                                                                        2e90771b128bfd3b8c134081b966b5e4dceb023f

                                                                                                                        SHA256

                                                                                                                        7697eec79bafcdb16497b39cd50e30cb0a2ace48a93b1d9604992265a41a9078

                                                                                                                        SHA512

                                                                                                                        cd8d4be51bd2213c350bfe149eabf5ec91e9e0cf8d3affd7a2e7be08893b508fe453a47830a10450825ac590d822a5fc759bb3ca7a2b5617b8a6b66567c64c36

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        12KB

                                                                                                                        MD5

                                                                                                                        325fddbf20b51b84ea7ca21c6bcb5c8a

                                                                                                                        SHA1

                                                                                                                        ab125a78ee36150972b59ba40f57c4d514af2a10

                                                                                                                        SHA256

                                                                                                                        4b8f65c6c71706ef14d79fef09bb2865c2ef8b9b941eb4f7e2b5fd3478d0dbc7

                                                                                                                        SHA512

                                                                                                                        7825db0ce01b33d65c6f165b7a6430798977412f771805238b9fc3402661e95c6da6e9f96924aae1159bf8018eabd663d0be2682f78b70011390ce01eb16c9fd

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        11KB

                                                                                                                        MD5

                                                                                                                        9186a4e55cbcba1f963456af0b85d59d

                                                                                                                        SHA1

                                                                                                                        66fa913ee0ad859978d8f6284711d41f1dd6c7ed

                                                                                                                        SHA256

                                                                                                                        6003fbbd9567e3f0a395bd1a7721c7a2818905bc8231262b59e89df948bbbda7

                                                                                                                        SHA512

                                                                                                                        ec2a910352162536af6d5431ce97abf3df211d646139a1ed496ed4f2acef5dc31258fef9eea363f302249144ff1b1ea36f605cbac5d942ec0928d0e5d376034d

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                        Filesize

                                                                                                                        640KB

                                                                                                                        MD5

                                                                                                                        d46d3f125f2015ec9896b1957627dbd4

                                                                                                                        SHA1

                                                                                                                        e6e6ea3ed2dccdb681a5b09e80713f8423a7bac9

                                                                                                                        SHA256

                                                                                                                        1c78fbb39da035ea94dccedd32007f4ae997e77bf2b4c58f0d98e4455fc330c5

                                                                                                                        SHA512

                                                                                                                        74e84fd93619a34ba91e6603039867e7ea76267029f4f17453c3142ae84b80a066e3734d3cf9d51ca4f775c29bfa68d43263dcfc374453a65ce951dc441e7e18

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.XML.bak
                                                                                                                        Filesize

                                                                                                                        9KB

                                                                                                                        MD5

                                                                                                                        7050d5ae8acfbe560fa11073fef8185d

                                                                                                                        SHA1

                                                                                                                        5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                                                        SHA256

                                                                                                                        cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                                                        SHA512

                                                                                                                        a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\D66F9A1D-EB80-4C3D-A671-04944878B051\Zrtu2hQ08VU_1.bytecode
                                                                                                                        Filesize

                                                                                                                        62KB

                                                                                                                        MD5

                                                                                                                        96c1e20969b2b98797e7b4ad443d0ce2

                                                                                                                        SHA1

                                                                                                                        262353ce56bb773d712ca67f54fec9c3834f5dcf

                                                                                                                        SHA256

                                                                                                                        317be8ba45136e53a8c2786eee9ed126d687753774c3aec68797f150474d0df8

                                                                                                                        SHA512

                                                                                                                        d52f30603fd9b739982a476330e7da9e1f3bf9360906fb37f111df51a3d1c48dbc85eeb31c420aa1fe8572340f5ec920e3e58ac3a9679554ed576f14a980648a

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\D66F9A1D-EB80-4C3D-A671-04944878B051\Zrtu2hQ08VU_1.metadata
                                                                                                                        Filesize

                                                                                                                        192B

                                                                                                                        MD5

                                                                                                                        63a6d0397d5d1c6e600b5f3e2a111262

                                                                                                                        SHA1

                                                                                                                        d3b077d5ecb5df1763370131ee9fd1ec5cb900b3

                                                                                                                        SHA256

                                                                                                                        12341115b57568751a9d7b7f7d8506c4ce2ce7ef9e582108cf1823a6cdd43d37

                                                                                                                        SHA512

                                                                                                                        52869d2a0af7490938f115c701000c05c7aae8413f906045738b549ca151142fcc1c356b77f50bf57fa003599b8a335776f98ccdca0aacbf9c9b8832d59a211a

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A
                                                                                                                        Filesize

                                                                                                                        314B

                                                                                                                        MD5

                                                                                                                        99d474476ad012e83a171939a495f480

                                                                                                                        SHA1

                                                                                                                        00f9a37f43295ecfbc4ce3ea70b510c3d6b1c8af

                                                                                                                        SHA256

                                                                                                                        44ab2b936fa579d330b3616578d87ef9c21db9c9d53e7505ce53e32f7ee67c50

                                                                                                                        SHA512

                                                                                                                        8d284219005b9b8f0d3e73e2779ec418a8475ced6f29d8a359fce7269c2557aaeabff2c035ad1f3cbcfba42866cf817e5d5cb3606afbfb83c60c4cd2f74565f6

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A
                                                                                                                        Filesize

                                                                                                                        404B

                                                                                                                        MD5

                                                                                                                        314b891add0ab3cbe6edcfe4022764d5

                                                                                                                        SHA1

                                                                                                                        cfd0a761550c749014ec762f1195b3c39ae65a3d

                                                                                                                        SHA256

                                                                                                                        8c438a33a65df85531f81f01e9d01011ddc3cbd5ed39a896b8d81f2d857d9f74

                                                                                                                        SHA512

                                                                                                                        7f8772249c678bd68e3f7c522167a6121edc515563ffb6754a9b7bfafbd046838f950b4530c3978c8000ad858e4adef667ad0182bd737a967eae36050cedcd96

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\000.exe
                                                                                                                        Filesize

                                                                                                                        2.8MB

                                                                                                                        MD5

                                                                                                                        f539c3682c460fa42bead6946205806d

                                                                                                                        SHA1

                                                                                                                        eb7b26a67c3d18db33d5f7ea28d031316696330b

                                                                                                                        SHA256

                                                                                                                        b90239adebfc00004ace5a37525026f5f3714334182c155b3801e11995d524cb

                                                                                                                        SHA512

                                                                                                                        8d49d60f9efdf9208cfa82cd9c846dc68ad4e1c2461e424035d5fe3cd46e00e7ab6f9c250ce7f835cc5b880fd20012da5f6161326dcc38d477398ad9a0c63b5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\000.exe
                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                        MD5

                                                                                                                        d5671758956b39e048680b6a8275e96a

                                                                                                                        SHA1

                                                                                                                        33c341130bf9c93311001a6284692c86fec200ef

                                                                                                                        SHA256

                                                                                                                        4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47

                                                                                                                        SHA512

                                                                                                                        972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\000.exe:Zone.Identifier
                                                                                                                        Filesize

                                                                                                                        72B

                                                                                                                        MD5

                                                                                                                        e6a602a9dd6e7986706bf3a960b7f9ad

                                                                                                                        SHA1

                                                                                                                        5ebc95f8613323b88625c61dc8fe38e66ec52c3c

                                                                                                                        SHA256

                                                                                                                        8c415625ec2105d4cd2f882eb23b07c029574f529d2d764de09b652320333ec2

                                                                                                                        SHA512

                                                                                                                        689f6191252a5f5173151e157debad7d3a86afb25a7c3be19fad871931b4641efa3e12d50883a28706cfb435a0d21fab5b5d2612d01ecc8f54f3a116fb35eb50

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\one.rtf
                                                                                                                        Filesize

                                                                                                                        403B

                                                                                                                        MD5

                                                                                                                        6fbd6ce25307749d6e0a66ebbc0264e7

                                                                                                                        SHA1

                                                                                                                        faee71e2eac4c03b96aabecde91336a6510fff60

                                                                                                                        SHA256

                                                                                                                        e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

                                                                                                                        SHA512

                                                                                                                        35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\rniw.exe
                                                                                                                        Filesize

                                                                                                                        76KB

                                                                                                                        MD5

                                                                                                                        9232120b6ff11d48a90069b25aa30abc

                                                                                                                        SHA1

                                                                                                                        97bb45f4076083fca037eee15d001fd284e53e47

                                                                                                                        SHA256

                                                                                                                        70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

                                                                                                                        SHA512

                                                                                                                        b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\v.mp4
                                                                                                                        Filesize

                                                                                                                        81KB

                                                                                                                        MD5

                                                                                                                        d2774b188ab5dde3e2df5033a676a0b4

                                                                                                                        SHA1

                                                                                                                        6e8f668cba211f1c3303e4947676f2fc9e4a1bcc

                                                                                                                        SHA256

                                                                                                                        95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443

                                                                                                                        SHA512

                                                                                                                        3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\windl.bat
                                                                                                                        Filesize

                                                                                                                        771B

                                                                                                                        MD5

                                                                                                                        a9401e260d9856d1134692759d636e92

                                                                                                                        SHA1

                                                                                                                        4141d3c60173741e14f36dfe41588bb2716d2867

                                                                                                                        SHA256

                                                                                                                        b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

                                                                                                                        SHA512

                                                                                                                        5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
                                                                                                                        Filesize

                                                                                                                        108KB

                                                                                                                        MD5

                                                                                                                        4f33915a9df95e35b636b8de30cef7b4

                                                                                                                        SHA1

                                                                                                                        099abe2428d58a941762a48587a74cc22e783886

                                                                                                                        SHA256

                                                                                                                        602034b6680a6bd410b20c6a4d416cf77c86a039711c83ae7cfeee0676c81fca

                                                                                                                        SHA512

                                                                                                                        d11c360ec93ae9db3988026a98e004a798aac12dde8b4a99b5016f38bd8f90b9ecaff0d21af8db708f8b16c1f160e3bd37da59cf4f1ed3ccc56d8df0918782f0

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                                        Filesize

                                                                                                                        173KB

                                                                                                                        MD5

                                                                                                                        4bf1f81eafa19d271f2619cda73aab59

                                                                                                                        SHA1

                                                                                                                        c93addea632ec24fd3001cf56c6ca933ba8d394b

                                                                                                                        SHA256

                                                                                                                        7b8fa30b1d7d1097597d233e2ad759f996de33439e0616efe0f8c169e7ffe771

                                                                                                                        SHA512

                                                                                                                        d9f9e49f455ac3f7e6aa80f3846d642375bc201ed8969ae6f6af2cd0156d7d76b26b90649b99c633e88274ec12a024b2895a2db0e12e6aee8d107975b1d65025

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
                                                                                                                        Filesize

                                                                                                                        396B

                                                                                                                        MD5

                                                                                                                        9037ebf0a18a1c17537832bc73739109

                                                                                                                        SHA1

                                                                                                                        1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

                                                                                                                        SHA256

                                                                                                                        38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

                                                                                                                        SHA512

                                                                                                                        4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Downloads\000.zip
                                                                                                                        Filesize

                                                                                                                        119KB

                                                                                                                        MD5

                                                                                                                        f5d73448dbe1ec4f9a8ec187f216d9e5

                                                                                                                        SHA1

                                                                                                                        6f76561bd09833c75ae8f0035dcb2bc87709e2e5

                                                                                                                        SHA256

                                                                                                                        d66c4c08833f9e8af486af44f879a0a5fb3113110874cc04bd53ee6351c92064

                                                                                                                        SHA512

                                                                                                                        edbdc1d3df9094c4e7c962f479bb06cdc23555641eeb816b17a8a5d3f4d98f4d1d10299fd2f9152d30e3fa9e5b12c881fd524e75612e934b287109492ee1520b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Downloads\000.zip:Zone.Identifier
                                                                                                                        Filesize

                                                                                                                        638B

                                                                                                                        MD5

                                                                                                                        050b66a3e62f0de50681efc1a7510742

                                                                                                                        SHA1

                                                                                                                        e33aaca889d08df69860549a2a38c078117d7616

                                                                                                                        SHA256

                                                                                                                        0e082c1ad5cf47398a576f20c7b178295049ed4e06d0a50d9810b3fcb75ba745

                                                                                                                        SHA512

                                                                                                                        2ece47e8e5533e476200a6e0b5ca12750be1e3d9a27772ac3b20d962c686eda9761989ad2af4226c451483bd1e92a4ef1b0ddc7527a75dd6541f021949632a37

                                                                                                                        Download Submit

                                                                                                                      • memory/2712-239-0x0000024532D80000-0x0000024532E80000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/2712-240-0x0000024532D40000-0x0000024532D60000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3252-56-0x000001D47A6D0000-0x000001D47A7D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/3252-60-0x000001D47A220000-0x000001D47A240000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3252-49-0x000001D479FA0000-0x000001D479FC0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3252-65-0x000001D47A530000-0x000001D47A550000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3408-867-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-878-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-869-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-873-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-871-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-874-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-875-0x000000000CC60000-0x000000000CC70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-876-0x000000000CC60000-0x000000000CC70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-880-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-879-0x000000000CC60000-0x000000000CC70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-881-0x000000000C200000-0x000000000C210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-864-0x0000000009880000-0x000000000988E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                        Download

                                                                                                                      • memory/3408-863-0x00000000098B0000-0x00000000098E8000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        224KB

                                                                                                                        Download

                                                                                                                      • memory/3408-885-0x000000000CC60000-0x000000000CC70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-877-0x000000000CC60000-0x000000000CC70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-886-0x0000000074C70000-0x0000000075421000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        7.7MB

                                                                                                                        Download

                                                                                                                      • memory/3408-887-0x000000000CC60000-0x000000000CC70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-851-0x0000000006090000-0x00000000060A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-844-0x0000000006650000-0x0000000006BF6000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        5.6MB

                                                                                                                        Download

                                                                                                                      • memory/3408-834-0x0000000006090000-0x00000000060A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/3408-833-0x0000000074C70000-0x0000000075421000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        7.7MB

                                                                                                                        Download

                                                                                                                      • memory/3408-832-0x0000000000D60000-0x000000000140E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                        Download

                                                                                                                      • memory/3408-1746-0x0000000074C70000-0x0000000075421000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        7.7MB

                                                                                                                        Download

                                                                                                                      • memory/3428-281-0x0000011426390000-0x00000114263B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download