Analysis

  • max time kernel
    465s
  • max time network
    467s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-03-2024 13:36

General

  • Target

    setupc-09-04.html

  • Size

    9KB

  • MD5

    5fef01686ebe5167e611274f4188f8be

  • SHA1

    92978588fb24129441f2d58e2d49178145c6ff5a

  • SHA256

    ec334bbe7790d4f023bc99f7af097403ef271220db711f54e2503d03dd3ffb44

  • SHA512

    0c862f9ea455bfaeb00c37502e7b5eb0ccf4378b49481af6cda9856120f07a6e14cd22eea44d6f062a43b00ce44663688d0086f711a78fc8843e066df2f6fcc5

  • SSDEEP

    96:wsuWzhAVrbtmqTVrxOfjmZ/pEm0gbfH1jPJjeIJumKF95RZjieojwXZkSqPbJ:htEe7m5pdTH1TJjeeu1hkrZ

Malware Config

Signatures

  • Detect ZGRat V1 2 IoCs
  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\setupc-09-04.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcb8ed9758,0x7ffcb8ed9768,0x7ffcb8ed9778
      2⤵
        PID:420
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1276 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:2
        2⤵
          PID:4016
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
          2⤵
            PID:1592
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
            2⤵
              PID:1204
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
              2⤵
                PID:4536
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                2⤵
                  PID:3676
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
                  2⤵
                    PID:2264
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
                    2⤵
                      PID:3988
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5180 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                      2⤵
                        PID:8
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5176 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                        2⤵
                          PID:3708
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1648 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
                          2⤵
                            PID:2748
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1000 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                            2⤵
                              PID:4928
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5676 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                              2⤵
                                PID:3416
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5408 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                                2⤵
                                  PID:500
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
                                  2⤵
                                    PID:4528
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5060 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                                    2⤵
                                      PID:2908
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5608 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                                      2⤵
                                        PID:576
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5172 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                                        2⤵
                                          PID:3020
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
                                          2⤵
                                          • NTFS ADS
                                          PID:1116
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5988 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:2
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2548
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:8
                                          2⤵
                                            PID:4768
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4832 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                                            2⤵
                                              PID:5096
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6028 --field-trial-handle=1820,i,18351521787322990214,7371934823596713161,131072 /prefetch:1
                                              2⤵
                                                PID:3564
                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                              1⤵
                                                PID:3844
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:3424
                                                • C:\Program Files\7-Zip\7zFM.exe
                                                  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Application65e9c331a8c1b.rar"
                                                  1⤵
                                                    PID:3160
                                                  • C:\Program Files\7-Zip\7zFM.exe
                                                    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Application65e9c331a8c1b.rar"
                                                    1⤵
                                                    • Modifies registry class
                                                    • NTFS ADS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    PID:4728
                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO872D329A\READ FAQ.txt
                                                      2⤵
                                                        PID:912
                                                      • C:\Users\Admin\AppData\Local\Temp\7zO8729C7AA\application_ins.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7zO8729C7AA\application_ins.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3792
                                                    • C:\Windows\System32\DataExchangeHost.exe
                                                      C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                      1⤵
                                                        PID:4840
                                                      • C:\Users\Admin\Desktop\application_ins.exe
                                                        "C:\Users\Admin\Desktop\application_ins.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3176
                                                        • C:\INSTALLER\IVNFDQWHXA.exe
                                                          C:\INSTALLER\IVNFDQWHXA.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:2520
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            3⤵
                                                              PID:3580
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              3⤵
                                                                PID:920
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                3⤵
                                                                • Loads dropped DLL
                                                                • Checks processor information in registry
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1208
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=UZfBnXM8WuY
                                                              2⤵
                                                              • Enumerates system info in registry
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:2872
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffca50a3cb8,0x7ffca50a3cc8,0x7ffca50a3cd8
                                                                3⤵
                                                                  PID:1328
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
                                                                  3⤵
                                                                    PID:2980
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
                                                                    3⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:2812
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
                                                                    3⤵
                                                                      PID:4484
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                                                      3⤵
                                                                        PID:2224
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                                                                        3⤵
                                                                          PID:3992
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
                                                                          3⤵
                                                                            PID:3696
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
                                                                            3⤵
                                                                              PID:880
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 /prefetch:8
                                                                              3⤵
                                                                                PID:3056
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,3015104037770631198,4521374959027823080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
                                                                                3⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:5220
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:2720
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:2472
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:2860
                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D4
                                                                                  1⤵
                                                                                    PID:2792
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                    1⤵
                                                                                      PID:1424
                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5916

                                                                                    Network

                                                                                    MITRE ATT&CK Matrix ATT&CK v13

                                                                                    Credential Access

                                                                                    Unsecured Credentials

                                                                                    3
                                                                                    T1552

                                                                                    Credentials In Files

                                                                                    3
                                                                                    T1552.001

                                                                                    Discovery

                                                                                    Query Registry

                                                                                    3
                                                                                    T1012

                                                                                    System Information Discovery

                                                                                    3
                                                                                    T1082

                                                                                    Collection

                                                                                    Data from Local System

                                                                                    3
                                                                                    T1005

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\INSTALLER\IVNFDQWHXA.exe
                                                                                      Filesize

                                                                                      304KB

                                                                                      MD5

                                                                                      b3081051b95ed4325d4bd2340a8fa590

                                                                                      SHA1

                                                                                      8ed95a69834de972a6162058f9a638c4b149a0bb

                                                                                      SHA256

                                                                                      068f679749652a20a9c9a991c2c9ee52a3529bc31d1277ffd2e3888a1f406cf5

                                                                                      SHA512

                                                                                      fd58117af174336f7b185a90bb381b59f1b1c54bb288f031b7f4cb0e8938a69e67648383677a0201941f6f4c5cc90e0f9e3029d83009387751e7db69a88db7fb

                                                                                    • C:\ProgramData\mozglue.dll
                                                                                      Filesize

                                                                                      593KB

                                                                                      MD5

                                                                                      c8fd9be83bc728cc04beffafc2907fe9

                                                                                      SHA1

                                                                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                      SHA256

                                                                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                      SHA512

                                                                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                    • C:\ProgramData\nss3.dll
                                                                                      Filesize

                                                                                      2.0MB

                                                                                      MD5

                                                                                      1cc453cdf74f31e4d913ff9c10acdde2

                                                                                      SHA1

                                                                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                      SHA256

                                                                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                      SHA512

                                                                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5ffd6c40-4729-483f-93aa-722af00afd78.tmp
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      d2e85f959fe59ead7f6a7ad4235d9415

                                                                                      SHA1

                                                                                      3d7566ac17dfaaac84d2a46122ed4dfbd3191b53

                                                                                      SHA256

                                                                                      5784d0563ff0c9baff40046a35126ec7e699f678a7dee428ccec55fbac2af1fc

                                                                                      SHA512

                                                                                      db1ab82d187e91e52785c8319bc181b5029a578575682ced7c818b9a67a7b5f7405bc4a2b40c5249e69ae09c01f90dd2a1617abab8c0a69c8d0de655baf0b7ff

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
                                                                                      Filesize

                                                                                      194KB

                                                                                      MD5

                                                                                      f5b4137b040ec6bd884feee514f7c176

                                                                                      SHA1

                                                                                      7897677377a9ced759be35a66fdee34b391ab0ff

                                                                                      SHA256

                                                                                      845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

                                                                                      SHA512

                                                                                      813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      Filesize

                                                                                      240B

                                                                                      MD5

                                                                                      4b339daf513e797dd714186795452fe6

                                                                                      SHA1

                                                                                      070289df8b8a0951804d83991842a56b1b36dbd4

                                                                                      SHA256

                                                                                      0612e4ef3d6556ee6a91898393091e27ce02e89d2980ae250d5326a1e253ef57

                                                                                      SHA512

                                                                                      134a414b3bbd0228a822f86809b722a4ea7cb4575087ad45410bb67766c0c6f4f31bb3cda0ee78c2c6d9ad62216f95ac072f2c46fad9dac513a5fb46440fd339

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      Filesize

                                                                                      264B

                                                                                      MD5

                                                                                      49937e0ce7952c2a4a56481a665c2630

                                                                                      SHA1

                                                                                      39e6b3a26f52373ab04ba46ae9be66e3cd6c82e9

                                                                                      SHA256

                                                                                      56cd28b725e810bf04a8be4ff435ae3ad6af27252a8cfb567944ac19f6ce7209

                                                                                      SHA512

                                                                                      1b7c583f0a837e6a9ca6cb805a97974196d90012501fd20c3655ce916ba14ee869015c6dce79aaaddca84dc6702fa0e786ada734aad3d33c66bcaa494864ac9e

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                                                      Filesize

                                                                                      148KB

                                                                                      MD5

                                                                                      b18ba71231512a8866ff4f9ab03f43eb

                                                                                      SHA1

                                                                                      03e60f67cbc2b5f181013af9fc3836a08a251a26

                                                                                      SHA256

                                                                                      74b9f1be77c23a7687067cb6d416e823d813227b5118c537bc3b567a4ce47e59

                                                                                      SHA512

                                                                                      a43770daaac16d63d2218368f2d85836b29cab929e63afb2206805af95b35e736e12855b8dd8bfd1e2a03dcc689cc54a5eae56f94f010a8c54902f519d2b30da

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                                                                      Filesize

                                                                                      20KB

                                                                                      MD5

                                                                                      039676a749c353638b6212c16463addc

                                                                                      SHA1

                                                                                      f9022b3019f55ee028376c7d20c3b4494a729105

                                                                                      SHA256

                                                                                      d1775d182e5d2d589f86cc0810f0aa0b1e5446145131e1366c2b966ba3b0d859

                                                                                      SHA512

                                                                                      e02875a1ebf25f9083ba3733cea98512c0448cdda1f74593ece387766486acbf8889dfdea67cadb65d7135fa1c841630aaa8a3114dcd538ee1c7ddbe117fd21e

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      e8c67174ae0f2f3d47c89bf06f8b3782

                                                                                      SHA1

                                                                                      46f5dff1c5cf4f14127fae7444a99fd6429c0a27

                                                                                      SHA256

                                                                                      46ed9b0fd9bf356dae37b0a73ec9adac85f96f9d6d772bf15d8debf39a5caef8

                                                                                      SHA512

                                                                                      978951942b4af13dce02b4164cc8d6cb5789e26adb72264b7ef4a691e83c070641c2709293781b336169a6e348ae2853d6da5aa7986fdeb36f10e7eafe8d774a

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      f9b431fecdb1b62155c1735fe7431db0

                                                                                      SHA1

                                                                                      be8f2050cd2168833ac1462f9477d423ab5980ae

                                                                                      SHA256

                                                                                      2df7809a0511c4fb1b4bf527949f9440338a2f53f3b0d52a88d30f6408f67ce8

                                                                                      SHA512

                                                                                      1f2067663b7f4eb765a7b347a7aa71378c38cc09cf46b6ae5754f339f36b8c71c6e35dd9302e5d91bef351e7426f5126fa4aa0b95a0a857221508e62596d1550

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      6374ed200adc90a2c1812f8b3be26116

                                                                                      SHA1

                                                                                      a10506eafc2bc8e897221e0595f3299aac9eef81

                                                                                      SHA256

                                                                                      357d632e71315e1c136069a944ad0976426f4077ae421e8cf777c5798dac3e6a

                                                                                      SHA512

                                                                                      cc96d316d91145e710d394e9afc79096b5fa307f396afab851d95ab625737efc4cf50d8e080538a7b94f5d5f17505e7a95055ed6b8680d0c2f1b6301d337e04b

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      3KB

                                                                                      MD5

                                                                                      7e08364106d1bcef07bba14fd95267b5

                                                                                      SHA1

                                                                                      f3fe1f1ad381bdec117a0b24bc0c612eb2591dbe

                                                                                      SHA256

                                                                                      ce3e224434225758d25a93e146bc1218f46186f190858fb8b9624b3877cdb60b

                                                                                      SHA512

                                                                                      f26d883538ac16d7e1cd7c736fb36f30106feabcaecd0850e516a17e795a082ac572d9e9a8bd3c9773fa603f92a09d2a5866a2f63127ea9a098ac3d8cea30256

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      872B

                                                                                      MD5

                                                                                      a9bbce95bef1d9adb492b51ecd8dcdee

                                                                                      SHA1

                                                                                      d5c4278d1e6b46dad6d85dadc669b36374fe23d8

                                                                                      SHA256

                                                                                      7ab305f93c5da41bd65f88314d747f45208c4c72a17e626b81d8d020e57590fe

                                                                                      SHA512

                                                                                      343d9671db580b6cf591b656201fff19337358530919530422c476e514c8dd709ba5e7e76f292c2815e3a1ffa47fa15d03a931bc317ae419cd9fcb5a002fa118

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      96d35e34f2a99eeda391789d0a9a189d

                                                                                      SHA1

                                                                                      b2ddeca97ad63a4db8c6a2024d95b3064320c23e

                                                                                      SHA256

                                                                                      1ec0bce57d5c4f5582dd0198199ab36c4ddd9474b1019902adfc43d705fb4cca

                                                                                      SHA512

                                                                                      37a343ffa1f8b07b0a286995b8c01baf6e8f66ea86420c08ae6cc6badeb6fbb3e031c9b32390f46c4aeb4640beb1b2f423f1ccd78ac7c097a01eceffc7b15aaf

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      d7ac25624a79d928a3bc2992c97208da

                                                                                      SHA1

                                                                                      2967d57c29a11f803aa46cb857e30167ec245c61

                                                                                      SHA256

                                                                                      0dae334fac179641fd93317c13821d99f001851243888a2d38e60084e31750bc

                                                                                      SHA512

                                                                                      55f0058824eec550f8267969bfa9d6b4cf150c24307c1f305ac2ff07ec7fd45c8845346b5e5f423b43dbe16d4909b65bf00c68e630806380c739a8473b5227e6

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      705be07a00072f7900d427eda4d1806a

                                                                                      SHA1

                                                                                      fa0251fa26228860317eefed9a6ae3741fbbcca8

                                                                                      SHA256

                                                                                      46f21ee65dd1bf5ac8c4b74c8cf3f284548cd0f241cc5bffc8ebe34e42cf96ab

                                                                                      SHA512

                                                                                      150bec869fba63a807757302551a00c3c2e15571547e89d9b7f09d329b3a577240606b19c0160cde9170c601be59df4824ad80f3214bcbbd3c16ad5e2b37c8c6

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      16a48fc444681278deb20ccd14d133a0

                                                                                      SHA1

                                                                                      38b5a6d367ea331ade0cef3e73eaf4f42a9e3db1

                                                                                      SHA256

                                                                                      170f84470ae7aa65c3c2bd7af7fd415fe732467d6ab4f04ee15667401d774570

                                                                                      SHA512

                                                                                      bc1dc96c02941622bae1a31a6dff095f6a446f01c17477e8adde097c5b13e0c13a9d962d669c7d2a7ba73811fbc76a80f9e685ce9b54c278e0c51060f2088ad8

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      08c80ce768c00741b888a453e0a10e08

                                                                                      SHA1

                                                                                      a9affbaf761712e48baf41ad65975fb5bf21e7f2

                                                                                      SHA256

                                                                                      1b375ea33b0c9d22fdea3ac7acfca90dab28f77feaee83d88752bbe1f7dbbc3d

                                                                                      SHA512

                                                                                      444a0748f711e61491fcc8cf6e2b1371b9abfcb46cbdbdcb4358ac3c652dd7caaf5056863290b528cef90b9f3e5dfaf9286629e90bf792cf4365190ff9eedfd1

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      5cefd961aca7e5853024c8b21b622e8b

                                                                                      SHA1

                                                                                      cd8a82d9000d1f800adb2adf857b40548299dca4

                                                                                      SHA256

                                                                                      77913418468d875973b88fbfef837987fd55ab3086cc0b0eeff42fd8712d1315

                                                                                      SHA512

                                                                                      ec37e561f270761e45ca73562fa93fd42a520ae12669ae39158363eea3320f0164890b27b15497283fc18a8fc29df4682a893f45c7c13c6f06070487659251d6

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      bf716fee285d4da14990618179c4c302

                                                                                      SHA1

                                                                                      16e5f5817dc8f5beaddfe4fe34f7a8e3f4b794d1

                                                                                      SHA256

                                                                                      4f1efcf91886b8df6a70da696ec52960806b15e979c953c0c5795c923ef96487

                                                                                      SHA512

                                                                                      fbdc50bb4794e578dc385597bc22583a53d633c112bf49b64afaa52fae1673632bd721e085863f5b8a76d30240ca81be9c85db80188441cb587311dc6e088825

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      7557e8fbf4ed899701bcfb5f95b95765

                                                                                      SHA1

                                                                                      e433d662ae6163ca0024051efd1ee9fdd4dd8f3a

                                                                                      SHA256

                                                                                      4dd1b73f437428cc97f7950a209452b9be70c0da1df6656f7670409f386c2e76

                                                                                      SHA512

                                                                                      de82b9324c2239b4e6b4b2f6d2637aa3e9a8f282b2aec00bf8efd49e522b1e28a22c05ccaa6d6008c8101a2ee7aa34f92b0d915d9e38b248f5b8fef6ca4dd2d8

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      130KB

                                                                                      MD5

                                                                                      6134c620197c6c2f9ffcc6e933d9358f

                                                                                      SHA1

                                                                                      fc587bd4917d4b01c0904a5d9a0eb9f4138335e6

                                                                                      SHA256

                                                                                      9046b927c56d372599a73e888e2bee26f2cee9c96dad0f030ad23cef60630354

                                                                                      SHA512

                                                                                      e600181aec95609d180addd23238edc123dae962c4eae686747381482f29d947fbe0c451d81ae3e0fc8d34409c4d8b55fe003a4cb841f861ada9363832e7e0aa

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      130KB

                                                                                      MD5

                                                                                      b2dd4f2eecc3ad9d35179e06b11c236d

                                                                                      SHA1

                                                                                      a7770e71307c25a982f90bb845bfade8b8ed4813

                                                                                      SHA256

                                                                                      cc4cdab687b687007281637af5eb2b1802b3491d8a0eeb14745de614fda0b869

                                                                                      SHA512

                                                                                      3c818c900a79bcb3c8141983540cf31dc5fed24bffb87a50ab693e4396671c330291181d5c361169395e25564362e5cffd9c59f023a2452971b523e6c02e821d

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      130KB

                                                                                      MD5

                                                                                      29c82c58ad9dada1c33afb9eaf013e30

                                                                                      SHA1

                                                                                      cecec308565e5002f352827e763e41e609420615

                                                                                      SHA256

                                                                                      18e0f13233696edda9c3f2e2b6b3d0bfb46e7e6b1ab64a8975d01752b602a62a

                                                                                      SHA512

                                                                                      c1c85b14eca0ab9593f96d18ac6285a480d427b192b2a6a3f96973f28488e037e55a17f311c5e76ae9c8ed56f4bd406953b1195f9fdec59a5a1d7c5936d966f7

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      130KB

                                                                                      MD5

                                                                                      9505321c0c2a4ad50b5071805e32eb92

                                                                                      SHA1

                                                                                      d8f4df075e01a4130c43b40abf4d716e5bbe68df

                                                                                      SHA256

                                                                                      a380ef22f77e43d41802475903cff7388df4c505ab7585b6eb5edb4e92e896cb

                                                                                      SHA512

                                                                                      5e3819998e33970822c175c6f5ec67ef52b210cb9730eea2676887a529fde1da2ce99e82d57fbf027939fd260781030f08d9c6fdf2907432915ce3ef5095024b

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      130KB

                                                                                      MD5

                                                                                      ae72748d26ee290b3349f510ee369b8b

                                                                                      SHA1

                                                                                      79901df50a6262116e38501f84880279884b5db2

                                                                                      SHA256

                                                                                      e76b95e6d7deee76d808201f0656de52beda10ad965b101e121ad05a74c7bc4c

                                                                                      SHA512

                                                                                      19723967c874984d69e663ed54eb19bc523238358703edd48f2f2d0c69e948797f6c4f6a72aeae68c17068f2c2f26f7dc2dd8d4478efcb16e31c8920edc6dc09

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      130KB

                                                                                      MD5

                                                                                      0f7619e427d6d16aad067873ea793c09

                                                                                      SHA1

                                                                                      72459cec364fe10a5ed3445cfeb6a4d52e732930

                                                                                      SHA256

                                                                                      ecbf7b2f74508858f1afc5231f3d3cffd7d12f888f79cc1d6c8f87ea1cb39600

                                                                                      SHA512

                                                                                      a0fa9b66539f43dd3f7d5a5ee66cb4f89325c2200982c640987c27f70e1b70ccdb223ea48a9b03b05f98d8774b63bef40128a50a3967b3359e1f2fcd8a5864c9

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                      Filesize

                                                                                      99KB

                                                                                      MD5

                                                                                      755b0268bae975f3c74b33d2f5ccce70

                                                                                      SHA1

                                                                                      1387f41b042e055f2bc2651fbbdd9bff4ad94fa8

                                                                                      SHA256

                                                                                      7e977faec63456afc3ad2588137c69d3eb4a86c5a44df4d6333db6be071a3221

                                                                                      SHA512

                                                                                      1853196dd29e4010dc12e17f7191502f9034c8521ffa1952bfdf66cf28e624323224d703c12bf3e503020d1a17208cdbcdc35d2294a766890f36dc5c396c3d2b

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                      Filesize

                                                                                      103KB

                                                                                      MD5

                                                                                      e64cfb511360f21269d8cb6615b4c36c

                                                                                      SHA1

                                                                                      145fd1766004d647c111402a4e899dad898b4b82

                                                                                      SHA256

                                                                                      8377fd1d24c98d477f0454aaa90bd6bf2af88cd139c152308a87bb73cf3a33a0

                                                                                      SHA512

                                                                                      fe4dce9f3df8220b8da1a89e53b9c34956a9d6ae099a76021ed4a07ac673406699796db2ffa49a6fb22eac258cbbb67a1608bed4dd033ac0b754a33994ad0b2e

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe586472.TMP
                                                                                      Filesize

                                                                                      92KB

                                                                                      MD5

                                                                                      8cd3b4a7a5642ee77c65964db34e3eb8

                                                                                      SHA1

                                                                                      2ce84416d4ded841ccd52f47430bfa06374a848e

                                                                                      SHA256

                                                                                      25006d5030205b0bb775651972307f8dd34788c3cd53d73be511c195bc69c4e4

                                                                                      SHA512

                                                                                      0c8ee2f2fc982a81d622859811a66dfa61edbca9f3cb937c43baf8062f396effe922c91b2e92f43a00c582146d54d83935eab2f8059e154d441223ac79ff1024

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                      SHA1

                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                      SHA256

                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                      SHA512

                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      ded21ddc295846e2b00e1fd766c807db

                                                                                      SHA1

                                                                                      497eb7c9c09cb2a247b4a3663ce808869872b410

                                                                                      SHA256

                                                                                      26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305

                                                                                      SHA512

                                                                                      ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      a0407c5de270b9ae0ceee6cb9b61bbf1

                                                                                      SHA1

                                                                                      fb2bb8184c1b8e680bf873e5537e1260f057751e

                                                                                      SHA256

                                                                                      a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd

                                                                                      SHA512

                                                                                      65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      Filesize

                                                                                      528B

                                                                                      MD5

                                                                                      37a069e3d94b57f0b7c377f778bfb78f

                                                                                      SHA1

                                                                                      b21d948cf1a47c80a4dfa8438fc86eb433e26873

                                                                                      SHA256

                                                                                      584b00c39656874e97fb9b74ff7b6cda892df81dfa0938404e2584563099f15b

                                                                                      SHA512

                                                                                      e691b7bf4bcb99c05eaa443f01e218a90a372ba8ddc6f5779aa84f7d09f2d10c02222c76e6db7e46b69429e2497bbf6384b58c889ab9741d312c6b9bea33d31e

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      89d404db51fe8707e363c743cc7e1568

                                                                                      SHA1

                                                                                      827173e9095c1061cae406a81f7f19191c528120

                                                                                      SHA256

                                                                                      d6624d50b514cf1bfc930f1b6da140fb59fb1234f8a38ac060db9c4f49b8158b

                                                                                      SHA512

                                                                                      5fdecf6440fd52792d02c26a2e98b7bd7cb2ee7e5e58188dcf6be9c3aa6b85c92d822cb788284f4af0c99d5ae8c8d5e1a85c44c92a4c257f9761dea27fb41628

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      5KB

                                                                                      MD5

                                                                                      7f57d144a1e22d34873ad759ebf4af34

                                                                                      SHA1

                                                                                      e32f056718a0e340189a366cf1e49545d02f76bb

                                                                                      SHA256

                                                                                      f910eae8f7c937e8c3ad62281e7380366ea23a3bb0bda96d97b0bc03c38d3412

                                                                                      SHA512

                                                                                      bafffd84e9a8e4d377784e8e79a85af18a24633ecff71702bb77f21ab618da5b9fa42d6e7c56640ef18dfd7183fb2272388c72f2a303369ce7ba344ebe41c0db

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      6aa92d1c8b217dbabcb058aec555d78e

                                                                                      SHA1

                                                                                      5222c966170405b3ec753e2d9ca6cb7309e4a5ed

                                                                                      SHA256

                                                                                      936bb01c8b40e0f91ad546e2874677a226d6e731ca272d96114d361c92e3b8a4

                                                                                      SHA512

                                                                                      c7cafbeadaf9fdf5ae024b02546ec0a3a8d45e6194695c3c70449cb8163f68b7d45589ffa65aa88dd34b3df7ea4133544938d8017f4a5b23affbc4d9c6020a75

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5fec0407-d67a-479c-84d8-7db5e2dc5fe1\index-dir\the-real-index~RFe5d47ca.TMP
                                                                                      Filesize

                                                                                      48B

                                                                                      MD5

                                                                                      75013d2401315f98cb853444a70215e0

                                                                                      SHA1

                                                                                      303dd0c0aab02190142acf62b110c97def6fe67b

                                                                                      SHA256

                                                                                      bfd74f865df812bcf0622b144837ee599f4eb17b2fcb94b3e57658dd0a807774

                                                                                      SHA512

                                                                                      6319fe15ab8fe4c125cf852cd009ab7bd90620b8742fae996b232483fa6c448beccb14eb6859dbd7ef453f3fb5010f6b7d0b5b8f3580db8ff7997e7a04122a1f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                      Filesize

                                                                                      89B

                                                                                      MD5

                                                                                      7b682984af8116fd6d5e0f76cc1b8a2c

                                                                                      SHA1

                                                                                      2e6b2cd634b1eb0b101d928faf64ae5d4fb8d48d

                                                                                      SHA256

                                                                                      b2e7b8b21ca3f51322b4cd6cb463390158b10be99ce6a176de6a5776bdf0dd48

                                                                                      SHA512

                                                                                      e3b7ed6cdb4f29efb4d398a46af2318d4ba213ce7831ca343dc5967fae0a7b6813ff65861b6cc162bf5fb0b82eb3d24668a90e9ef2d11e3f3b0d24d17925b872

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                      Filesize

                                                                                      146B

                                                                                      MD5

                                                                                      328a5ee08a61d9d213fa60df37c1dbac

                                                                                      SHA1

                                                                                      b76e5249c4cb1030db55879c858b254f0cf11012

                                                                                      SHA256

                                                                                      8263cbeaac574e9e547abd478a17c72a1ebf918f6e0fe84ee0734d474634a5ad

                                                                                      SHA512

                                                                                      314d831482ed824be97917a0bac92e80e8519a77148715791bc6781e9eeb0d06815ba7db42346f28cce18daa8938a8f29d35306669fca0c2bd0eb7b29133d806

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                      Filesize

                                                                                      82B

                                                                                      MD5

                                                                                      6e28387067c083dc73c019e32fd4b161

                                                                                      SHA1

                                                                                      155e8ab557315d5c8573c3fe94ccae34d6afa67d

                                                                                      SHA256

                                                                                      1d65fbac58a95200caed8a265849c0e97c0368ff0dca7139eef024d2350d374f

                                                                                      SHA512

                                                                                      0495e06d354a15e8a193ed33c2249f46469c70f5f29c6271b2d81231e8c176446c015b9224f6ab858d3cd5b75336bb372cd6726e67223f7f45187d6aa0db8278

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
                                                                                      Filesize

                                                                                      84B

                                                                                      MD5

                                                                                      218c31a5a1a895f977ae3cf646060813

                                                                                      SHA1

                                                                                      9591faf2cef27b67a2a3805819608b4b4a946b04

                                                                                      SHA256

                                                                                      8e77d08455ce01c5ad40b729425fc1ec2b7bc913fd953d8ba13fa6afbf3bba1b

                                                                                      SHA512

                                                                                      995d3218b0a768b465ee4a074c2bd95cf05889117c866d73480330207134db2afdef51f268c5a21d57752c0ed86602cb59ea258dc1367ba1791de3e9dc72da89

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
                                                                                      Filesize

                                                                                      16B

                                                                                      MD5

                                                                                      46295cac801e5d4857d09837238a6394

                                                                                      SHA1

                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                      SHA256

                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                      SHA512

                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                      Filesize

                                                                                      72B

                                                                                      MD5

                                                                                      d82adbc0098b9bcbe3ac65b6293d7735

                                                                                      SHA1

                                                                                      ab22701b0041a9cbfffaa91f5e14f21d17edb90c

                                                                                      SHA256

                                                                                      ffdf6b1ae86607ca237a456a61339d9eb8d20e53e33d6c6bd152c53836cc6004

                                                                                      SHA512

                                                                                      ec53bf7033f71f8bc1c1ce48a5efa501adc732ce9f9b054530755ad0900b81b855203c495cd658d128ebf17251aac919cdfe4d10bab3f36e4e52c2eaf0d80e46

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d476c.TMP
                                                                                      Filesize

                                                                                      48B

                                                                                      MD5

                                                                                      0fe753402fd8b436233860b9fd497e03

                                                                                      SHA1

                                                                                      5f40ee6e7f666241503572637de20edf431a042a

                                                                                      SHA256

                                                                                      c6a4109753fdac4f8b893ec3649603461547c81c4dc51317e6687c54863f11ae

                                                                                      SHA512

                                                                                      02015f1b5891b3e2040f9d7e3c8d56903a9412c1854f2cbbcb914400325abcf2588123871406c9e8a1c67c7f6a249d0d069adf65b766b69338b6cf0e0c0281db

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      e3b356ebd4e38e3b5d8ebd09c495f65a

                                                                                      SHA1

                                                                                      c74f87e84df4129c9a3d313c916dc0898c77301f

                                                                                      SHA256

                                                                                      ffc913b47e01324d87a19ddc56c9009b75efe8e8f8e4abc92cdfe1160a052040

                                                                                      SHA512

                                                                                      2f79940a9936f46e73e491aeae87cd102d1972131380288edf3be16b65537d2d830788cea4da291b3f0aafa7642427b32f40c01e5dac15e2b7384a0923aa31ee

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      31490a459c198da08ac2babda98140fe

                                                                                      SHA1

                                                                                      7d0ce403bc81bf92be58d7ad48763948920e8737

                                                                                      SHA256

                                                                                      f1cbb3423476a4c6fac691d9dd20e577518781c4ca79874e74d52f2961a62276

                                                                                      SHA512

                                                                                      1ff445b321634318fdca6fd7f946088a8309d283824205b5d1f9ac4d544d492bd608aa324e292ce99d332c747be3f49a59090b91e46e296335822d5d400fc715

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      f2de638a4259125fdc63c3e174803714

                                                                                      SHA1

                                                                                      c2dc76d32dbc368e8b576a5dd9e0a2a7a5d6fa66

                                                                                      SHA256

                                                                                      c76921cb128864fa1ede8f5f96285a688474149a4d0ef6f15ae131250649a297

                                                                                      SHA512

                                                                                      625a76f433d1b50172950eea73425706e5be7547d589f0b660d7ffab6440f9f1542acc1944d20d64ba493c15c420593b12b53e6ad8fe181c0134001581aa7b19

                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO8729C7AA\application_ins.exe
                                                                                      Filesize

                                                                                      1.6MB

                                                                                      MD5

                                                                                      e7f414274e5e6f251504e6808e1b73b9

                                                                                      SHA1

                                                                                      3ac745069fdd872cd118714140dcd95e2b82e1fd

                                                                                      SHA256

                                                                                      684af1505cae78c1e62593c9b8d0923ee7f0806c12b53e163d48a566d17d3bb2

                                                                                      SHA512

                                                                                      fcc56edbd59c9bf2d651f31f74b7c80406f448598c36f9bc9cd952e8f5cf68396c7985b9a906b75e8c365f961d12b3ffc14f0c6a3ef1fea2916317eafcf43365

                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO8729C7AA\application_ins.exe
                                                                                      Filesize

                                                                                      31.9MB

                                                                                      MD5

                                                                                      e75e454748a76dcd22c260a7790f09fa

                                                                                      SHA1

                                                                                      6f3060e4b17daf0c5163547ad8472a19932bb922

                                                                                      SHA256

                                                                                      b753a888a05b15213c78a92f74574d29224e4e3da1fbb468af189ce714bb864a

                                                                                      SHA512

                                                                                      6ffa0af69a539da89d984c1c621b0381dd96b898863371f95bd7f5551f7d703ade8e27c8565bf2c5f9da0f0aa6e830f3a4678133e0b49e71fa0f777a83d72b4e

                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO8729C7AA\application_ins.exe:Zone.Identifier
                                                                                      Filesize

                                                                                      104B

                                                                                      MD5

                                                                                      5e4ae3782360a6bf5b5d192f6520d53d

                                                                                      SHA1

                                                                                      d111ad1f6619c4be1fcb7226a57920048099bc9d

                                                                                      SHA256

                                                                                      f291f6642ff061a82f3ef1cfb780134c58c541a38d4970e968b25957e348863f

                                                                                      SHA512

                                                                                      b1e059bb55296dcaf52f2da9de2417750805d0f8bc4cd1f9e1a88a35562e393a195b9a2a073a5c128fe090b43406b2fdeb7b697c6001ca47367d5bfe235eaa8d

                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO872D329A\READ FAQ.txt
                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      c66231fefe3ebff60e0a000d8400d8bb

                                                                                      SHA1

                                                                                      91a9959c65671ad0e04199ac893b34948dd3bf31

                                                                                      SHA256

                                                                                      4263bbb38b26031fe6a586e509323bf1ab7630518862832d689e1156993f262a

                                                                                      SHA512

                                                                                      78d704cbe2c8b7f219baafb4e908ca2697dc400c02e0d403495dc08d9faf16f8591294ab69a777d011a7e68524086034c7d2eae1ac4fc02d75ebdf9eaa404a48

                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      f3b25701fe362ec84616a93a45ce9998

                                                                                      SHA1

                                                                                      d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                      SHA256

                                                                                      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                      SHA512

                                                                                      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                    • C:\Users\Admin\Desktop\data\data.dat
                                                                                      Filesize

                                                                                      1.2MB

                                                                                      MD5

                                                                                      deac8b9e2492f6acf0abaf8b41793f18

                                                                                      SHA1

                                                                                      701b0938e2c6f9ddf1584665a1ffc4edabe6b386

                                                                                      SHA256

                                                                                      89110d5ebab645fede86872302d13ba2feb4909186bad302cd29b61cebcfe3a2

                                                                                      SHA512

                                                                                      38a20e695f4bb72f24f708ed5df12792d622ac7712af796f5ae7d8cc5269016078352e3302bbd246e2a69d1fb759b8835f7c19e0b653ea863b215174fe0208c8

                                                                                    • C:\Users\Admin\Desktop\data\program.PNG
                                                                                      Filesize

                                                                                      696KB

                                                                                      MD5

                                                                                      a3d4494188555fd642820346806fd1d8

                                                                                      SHA1

                                                                                      53a37fb21d1fdc91cdea14721eeecac83cc2825c

                                                                                      SHA256

                                                                                      ace20dad2b8ef82a5f8674afc8e9ca05f5f3f63efc798d66b43eb7124dc802ca

                                                                                      SHA512

                                                                                      a4265bf8fb50fbdb1b13b3d03126b2ec354cbd4c0ee9baa51911700e1be73753f549b1a8cdace269b674afaab04b03f545a2a383f3fd8a0b7898b8498a4a25e4

                                                                                    • C:\Users\Admin\Downloads\Application65e9c331a8c1b.rar
                                                                                      Filesize

                                                                                      7.7MB

                                                                                      MD5

                                                                                      641672fdd309cafb197f1339636bec52

                                                                                      SHA1

                                                                                      3d1982139974f96079776ac42da340fb0e883f0d

                                                                                      SHA256

                                                                                      810295db5134be6827d9397582ea8aa60a3d6d8873dac50cfd2cf04ebdf51c91

                                                                                      SHA512

                                                                                      b8c68dd1cc841974fadc30f67bc2a4fe6b16bb07201c7f64b15a48f18d0479ad04d17e4b4f2e93e627bf163e5d4d211b034d264e1e53f691024842dbe2dc9372

                                                                                    • C:\Users\Admin\Downloads\Application65e9c331a8c1b.rar:Zone.Identifier
                                                                                      Filesize

                                                                                      26B

                                                                                      MD5

                                                                                      fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                      SHA1

                                                                                      d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                      SHA256

                                                                                      eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                      SHA512

                                                                                      aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                    • \??\pipe\crashpad_3892_ZMOOUWOAQAQPEEDT
                                                                                      MD5

                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                      SHA1

                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                      SHA256

                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                      SHA512

                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                    • memory/1208-483-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                      Filesize

                                                                                      2.2MB

                                                                                    • memory/1208-585-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                      Filesize

                                                                                      2.2MB

                                                                                    • memory/1208-584-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                      Filesize

                                                                                      2.2MB

                                                                                    • memory/1208-480-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                      Filesize

                                                                                      2.2MB

                                                                                    • memory/1208-496-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                      Filesize

                                                                                      2.2MB

                                                                                    • memory/1208-497-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                      Filesize

                                                                                      972KB

                                                                                    • memory/2520-476-0x0000000072E80000-0x0000000073631000-memory.dmp
                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/2520-494-0x0000000002610000-0x0000000004610000-memory.dmp
                                                                                      Filesize

                                                                                      32.0MB

                                                                                    • memory/2520-475-0x0000000000050000-0x00000000000A2000-memory.dmp
                                                                                      Filesize

                                                                                      328KB

                                                                                    • memory/2520-478-0x0000000004980000-0x0000000004990000-memory.dmp
                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/2520-495-0x0000000072E80000-0x0000000073631000-memory.dmp
                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/3176-586-0x0000000000DE0000-0x0000000002DCC000-memory.dmp
                                                                                      Filesize

                                                                                      31.9MB

                                                                                    • memory/3176-581-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3176-548-0x0000000000DE0000-0x0000000002DCC000-memory.dmp
                                                                                      Filesize

                                                                                      31.9MB

                                                                                    • memory/3176-582-0x0000000000DE0000-0x0000000002DCC000-memory.dmp
                                                                                      Filesize

                                                                                      31.9MB

                                                                                    • memory/3176-601-0x0000000000DE0000-0x0000000002DCC000-memory.dmp
                                                                                      Filesize

                                                                                      31.9MB

                                                                                    • memory/3176-587-0x0000000000DE0000-0x0000000002DCC000-memory.dmp
                                                                                      Filesize

                                                                                      31.9MB

                                                                                    • memory/3176-588-0x0000000000DE0000-0x0000000002DCC000-memory.dmp
                                                                                      Filesize

                                                                                      31.9MB

                                                                                    • memory/3176-460-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3792-390-0x0000000000720000-0x000000000270C000-memory.dmp
                                                                                      Filesize

                                                                                      31.9MB

                                                                                    • memory/3792-389-0x0000000004F30000-0x0000000004F31000-memory.dmp
                                                                                      Filesize

                                                                                      4KB