Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

07/03/2024, 17:12

240307-vq9qasgd66 1

07/03/2024, 17:11

240307-vql91agd49 1

07/03/2024, 17:10

240307-vpztpshd2z 1

07/03/2024, 17:07

240307-vm6t8sgc75 6

07/03/2024, 16:58

240307-vgylnshb5t 8

07/03/2024, 16:58

240307-vgsqeshb4y 1

07/03/2024, 16:49

240307-vbnjhsfh89 8

07/03/2024, 16:45

240307-t9tyhsfh44 8

Analysis

  • max time kernel
    466s
  • max time network
    456s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/03/2024, 16:49

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9351e3cb8,0x7ff9351e3cc8,0x7ff9351e3cd8
      2⤵
        PID:2284
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:1640
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:464
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
          2⤵
            PID:2100
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
            2⤵
              PID:3736
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
              2⤵
                PID:3548
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3204
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4396
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                2⤵
                  PID:128
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                  2⤵
                    PID:1376
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                    2⤵
                      PID:1584
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                      2⤵
                        PID:1356
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                        2⤵
                          PID:4948
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5496 /prefetch:8
                          2⤵
                            PID:3308
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6196 /prefetch:8
                            2⤵
                              PID:1048
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
                              2⤵
                              • NTFS ADS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2416
                            • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                              "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:1956
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1232
                                3⤵
                                • Program crash
                                PID:2420
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
                              2⤵
                                PID:4352
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1320 /prefetch:1
                                2⤵
                                  PID:3392
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1760 /prefetch:8
                                  2⤵
                                  • NTFS ADS
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4832
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5960 /prefetch:8
                                  2⤵
                                    PID:4600
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
                                    2⤵
                                      PID:4120
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4780 /prefetch:8
                                      2⤵
                                        PID:1784
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
                                        2⤵
                                        • NTFS ADS
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1596
                                      • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                        "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:4920
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1424
                                          3⤵
                                          • Program crash
                                          PID:4844
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
                                        2⤵
                                          PID:1852
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6484 /prefetch:8
                                          2⤵
                                            PID:4076
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4876 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3044
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
                                            2⤵
                                            • NTFS ADS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1096
                                          • C:\Users\Admin\Downloads\Avoid.exe
                                            "C:\Users\Admin\Downloads\Avoid.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            PID:4636
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                                            2⤵
                                              PID:3960
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
                                              2⤵
                                                PID:2952
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
                                                2⤵
                                                  PID:2916
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
                                                  2⤵
                                                    PID:2672
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7072 /prefetch:8
                                                    2⤵
                                                      PID:1916
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6508 /prefetch:8
                                                      2⤵
                                                        PID:2348
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6876 /prefetch:8
                                                        2⤵
                                                        • NTFS ADS
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1456
                                                      • C:\Users\Admin\Downloads\ChilledWindows.exe
                                                        "C:\Users\Admin\Downloads\ChilledWindows.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2308
                                                      • C:\Users\Admin\Downloads\ChilledWindows.exe
                                                        "C:\Users\Admin\Downloads\ChilledWindows.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1664
                                                      • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                                        "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:4744
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1424
                                                          3⤵
                                                          • Program crash
                                                          PID:1884
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
                                                        2⤵
                                                          PID:1432
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5628 /prefetch:8
                                                          2⤵
                                                            PID:1116
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
                                                            2⤵
                                                            • NTFS ADS
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3912
                                                          • C:\Users\Admin\Downloads\rickroll.exe
                                                            "C:\Users\Admin\Downloads\rickroll.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:3976
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
                                                            2⤵
                                                              PID:2916
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
                                                              2⤵
                                                                PID:2416
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
                                                                2⤵
                                                                  PID:2832
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1528 /prefetch:8
                                                                  2⤵
                                                                    PID:4204
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7044 /prefetch:8
                                                                    2⤵
                                                                      PID:4928
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6800 /prefetch:8
                                                                      2⤵
                                                                        PID:1672
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5136 /prefetch:8
                                                                        2⤵
                                                                          PID:2384
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6564 /prefetch:8
                                                                          2⤵
                                                                            PID:4612
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
                                                                            2⤵
                                                                            • NTFS ADS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:2952
                                                                          • C:\Users\Admin\Downloads\Trololo (5).exe
                                                                            "C:\Users\Admin\Downloads\Trololo (5).exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:4780
                                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                                              taskkill.exe /f /im explorer.exe
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:960
                                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                                              taskkill.exe /f /im taskmgr.exe
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2144
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:2684
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:3556
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1956 -ip 1956
                                                                              1⤵
                                                                                PID:128
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4920 -ip 4920
                                                                                1⤵
                                                                                  PID:4592
                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
                                                                                  1⤵
                                                                                    PID:2884
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4744 -ip 4744
                                                                                    1⤵
                                                                                      PID:4928

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ChilledWindows.exe.log

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      01634db740c4b6af1e97697b928c19a7

                                                                                      SHA1

                                                                                      c2450780121e171e6a30222b0b6ff486806b39c4

                                                                                      SHA256

                                                                                      ae1e51aa14401830ff1d9a7e3b71a98f6fabfc3372a38ff64ad6622334b40023

                                                                                      SHA512

                                                                                      4030707da446012033e90e1f273d9229a30c9c6a479a4517b9693d0ce80fb4f2e3212496d996b8f96f7018b478ba014ebd53849f3357ce6da8709aacc647bee6

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      d459a8c16562fb3f4b1d7cadaca620aa

                                                                                      SHA1

                                                                                      7810bf83e8c362e0c69298e8c16964ed48a90d3a

                                                                                      SHA256

                                                                                      fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a

                                                                                      SHA512

                                                                                      35cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                      Filesize

                                                                                      152B

                                                                                      MD5

                                                                                      656bb397c72d15efa159441f116440a6

                                                                                      SHA1

                                                                                      5b57747d6fdd99160af6d3e580114dbbd351921f

                                                                                      SHA256

                                                                                      770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab

                                                                                      SHA512

                                                                                      5923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                                                      Filesize

                                                                                      424KB

                                                                                      MD5

                                                                                      e263c5b306480143855655233f76dc5a

                                                                                      SHA1

                                                                                      e7dcd6c23c72209ee5aa0890372de1ce52045815

                                                                                      SHA256

                                                                                      1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

                                                                                      SHA512

                                                                                      e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      57114f9a16d26b1dd8ec2f940c91e316

                                                                                      SHA1

                                                                                      8d40e375c058738af4385db31ef79cc5421be4ed

                                                                                      SHA256

                                                                                      e7baf8f1b2070a05e29fdea86f8031911b63d4255d4b47accc59ab627d15197d

                                                                                      SHA512

                                                                                      2dcdb4161b9af6a6756ec19790fcf2e6bad8d569dd4fd837f233369727a969c8aaf971f05d9c4108198b0dea30b28d6459a0090e291eca1201fe167e5b9453aa

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                      Filesize

                                                                                      579B

                                                                                      MD5

                                                                                      e51401bdf1eae288a9ba5d952ebb3aa9

                                                                                      SHA1

                                                                                      5effd82fee8231e1294fd404dd1f10caf5c41fd2

                                                                                      SHA256

                                                                                      a08ea4c022c5207583d92dedf27194f6d81335b90bef42e90132333220a52fa2

                                                                                      SHA512

                                                                                      f777e86f2eb64d2c31afba76f544f9a65392b0d77de18e16d6a2b5534f43febc083f757d37c0719b29b556c5f73b1238c0857ee7b9a6e18c0c9c99ca54133edb

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                      Filesize

                                                                                      579B

                                                                                      MD5

                                                                                      8d2e35ef5e680209262a2ac011f22a63

                                                                                      SHA1

                                                                                      3da604fe13d647f45c5236949de0a1cc3d3006dc

                                                                                      SHA256

                                                                                      9a51cbfc34a99cd5e8540827f9796364cbf35b01e6b535b7e06e51bd9778dcd8

                                                                                      SHA512

                                                                                      4eb414626c9fd3c013cf1dc2cc3303d25002505f97eb1f1f1420653277333b96710946b9b9bfde5dc3889b2259df5259fc23e23df29dbfd5df94c51b41fe8aa1

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      5KB

                                                                                      MD5

                                                                                      050b72390e3bcf9e9b941918304792b7

                                                                                      SHA1

                                                                                      57ff5cde46d5f086b6481bee6143b29797ef8f7b

                                                                                      SHA256

                                                                                      26d4a2d7b72c12c489c285825ee79880994daccaa841fc7b862253bef76a8ace

                                                                                      SHA512

                                                                                      03aedd996195d3b4613bddad531c88a6fc5b7691a51bcdeefa56201db49f185247a685446ea8b2e0e6c898291965a9f040394526f656596d17a113350d6c00a0

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      834d9b3557cea4c0f4c018c679736789

                                                                                      SHA1

                                                                                      a1668d9df224b43d4ab87a93260bcf3a1150ca5b

                                                                                      SHA256

                                                                                      53c681abd31711c868c275e575f3fbe69a18171efa6965dc4575c6af0ca9c851

                                                                                      SHA512

                                                                                      55a16ae0593d349a0d281500a9f1a3f5636553ae35214920258b08fb61eea5be5cacbd1ccedb5b97b8944edbc371a140d66fbed28188b49b1b35875dd1fa2117

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      2fc2842f5c437d6bdbe0ff76d53c42a6

                                                                                      SHA1

                                                                                      109474305c4715ae2138fa19f0a17ed0ef4773fd

                                                                                      SHA256

                                                                                      8abbf6fd794aeb2b228f8f467c69b1e7a9e18f026b2ac569d6c092df54cafe5f

                                                                                      SHA512

                                                                                      8f80dd21526d33323a2726ea062e1d349d697051d53b8604f867849f1fabf4335e059c8550baab7b724ac2009008f7e786c3c8fc8eab6d63c682ea93db2d1146

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      b8fd4a13b860325d24765f3347fcdb1c

                                                                                      SHA1

                                                                                      f4670e986a43318e0e62db59c106379a2538ce67

                                                                                      SHA256

                                                                                      5942b7e4a6c8aae821929eb5ef56470b70c334d5d9a3bbca2446b380b9bfc61e

                                                                                      SHA512

                                                                                      73932eb6d0a1545594f3dc2a6ab271e334e34a3fb7b1ace32322d9bb6ea6da1e6a657eea9eff89cd1258c355bbf1a1b88bbbde8687adb83ac803fa6f2488240d

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      8c12601b14416be2961b7e6efd031e87

                                                                                      SHA1

                                                                                      9e0445091d9a36dd5e779b171b05ad2574a55701

                                                                                      SHA256

                                                                                      db8554a4c6326ec9da2f4941ab0ea8935b4d0dfdc882db0fa008a3b7ae3cf7b2

                                                                                      SHA512

                                                                                      8e617c59faa4c9b97d7e36f901c105b20d05fa2feb7fa3f1a4e6e8928aa8e4482afe125811fa36b559de41982401384a2a0c5b4486f71e34029056e37001254e

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      62c51f57322c200f441e85bf2bb74538

                                                                                      SHA1

                                                                                      3f10e292077b3ec1150d010cb755c902542ccc1f

                                                                                      SHA256

                                                                                      a38174759dd51751cc15b2908b48ae23be7eb089a8ca10bf069e39f89cad45c4

                                                                                      SHA512

                                                                                      e83ded745b5aeb23fa0a0b894920ef614768de64723b3252899ea9ee9b44a2d496f17d4519a8cbf833374f0259ec2d7095e9ddcfac0232c39493b761d0233f4f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      25142ecd597aed00d3d139c83b214d49

                                                                                      SHA1

                                                                                      0899fed93503312c6bc8cdebd01ae97464c19cc1

                                                                                      SHA256

                                                                                      799e23d785357a19458df4dee911f477778bc1d370f44f4a69e9528816b4c939

                                                                                      SHA512

                                                                                      8cc164ba9e0443a4b76813195d09df7b6a52d87887179ec0e31c543dfce5111f88ebde500c5606b889308d0cd35dd8ab66723dd9387043effb31e055097b6fb0

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      24799f379791aa2c2b66ee15859bd98c

                                                                                      SHA1

                                                                                      d22da9fc649232fc5967e847305edbca7b240e22

                                                                                      SHA256

                                                                                      a13ee40f76f2650cf987486fee1fc9ce7d8e6c477fd755c1f1109928edb37d45

                                                                                      SHA512

                                                                                      1305dd759f9a0e5a1f8bbc12908328212faf98b812e135c4bb79d710de34ec3cd53554965d55ba9b4f55be72f707807800d1e3fec8db13bf5af4d95f8fc5633f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      8e9792dbca0a13b5458bb981eadb073d

                                                                                      SHA1

                                                                                      bc5f0e52153d874a31ca54915ffbaeecc36a1a4e

                                                                                      SHA256

                                                                                      5307c8c51fb032add873c9fd157dfc5c90165040d829f22569c91462fc55e53f

                                                                                      SHA512

                                                                                      cf83de2a0cc83311335b51a474ca8e72f01e0d67196b17b870edaa18796e581ceef27038f5931c451aeace80f9135365c713cff1221150b5c5392870af2930f1

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      d2913e59fa674bcb69cad0435a12b436

                                                                                      SHA1

                                                                                      892e8d008f18eb0c115121d3163c6d16b60e948d

                                                                                      SHA256

                                                                                      7dd84e20d4dcf2e21455b7d59a4bd870c5add469ef5360a4f4696dfa9d624821

                                                                                      SHA512

                                                                                      43f77a1155bb330fd5ebaf6fceecdfa62bb470a469aa4d7f280971615be9d739866ff5921a7f64f8f31eeacce18e35970e070cdeb1431ebc9f2db5b1134b4ba7

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      74994e8190a04ac67106e5a4026a8e1a

                                                                                      SHA1

                                                                                      b410e6ffa09cf1627699ad8f735a29d3a2e31995

                                                                                      SHA256

                                                                                      60729c33b8562b3fa2dfa505383ae3be645f9ee70698c5d4c415c066923c5305

                                                                                      SHA512

                                                                                      610b7b2676c24ee07a9d8ad6f8116bded07c2d784273ce8409bce50160b1e4e873267347d1fd37f3cf6d1796126624fc608f23c43e5a8b75e5836726bb5f0bd7

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      874B

                                                                                      MD5

                                                                                      1139c85225ece37aca03a4c104927f70

                                                                                      SHA1

                                                                                      9c8936cdfb6c2dfbf282f205b5cbc350be9eb674

                                                                                      SHA256

                                                                                      3c6fb98a72841163ba710b2b6769e5c4795f7f8251fd2319c3de39c71b60da47

                                                                                      SHA512

                                                                                      d3bce71afa8b43ea503c9296661ce283e7a0ffc83786e42bb35ef2b781a99c4d2f4712b30032d9c3d3e5cbe5fb713384451a2a4c863286556cb36a0461239ea5

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      814e52616b5e6d71ca0f42e8ae960ecd

                                                                                      SHA1

                                                                                      a382fd2969c981732008e5fcc5fc35223c5d1d85

                                                                                      SHA256

                                                                                      84f421f557b127f3b8f414185f17eaba969b41548bec5721cdb32d952e1901d9

                                                                                      SHA512

                                                                                      0b7b462720c396b09913fd09ff12b014ea8eef25ea59f964734f7dec125c454aff66e50683e02bfe6aa8f22433dcc5f1e77a6f011e2266b2d0f343c7116d378a

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      d9d44a243a70da67eb95a1639532f7e1

                                                                                      SHA1

                                                                                      20837b66e609eee169e01bd43005ab47ab04ea8c

                                                                                      SHA256

                                                                                      7389958b5c29b9873c0bdf227688901e583f1d3017b482d285c5a15f132eb507

                                                                                      SHA512

                                                                                      555015e9841d7d787061cb53fe10306a157552e975ddf2e531bb9157616ef5d70303b4df25de0415b0062c45729bfaa7b32460060db83c19cf6b7e0f3cd49bb6

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      aff9200d5b014644c6b492e5cc3a931a

                                                                                      SHA1

                                                                                      ada9df098aa63948ecaba9c125102ed06d3c2925

                                                                                      SHA256

                                                                                      f6a8c47aca8602282ed38f4a7c7b6b15e2fbace1eed6c0bc41a9c1ea0ba3786b

                                                                                      SHA512

                                                                                      2938916615cb07707e4ec03d63ac32c37321470c21bd8ef393c3e9d159d983a1aeeec89247e3dcf163d1fe574f913796286b57a5c623fe37fbc5ff192b2da28d

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      bb9c9ed9f6f1a179012b5079cf7fead3

                                                                                      SHA1

                                                                                      46236a5986b1fd61f39cc7edfa0a8da10a1f4e42

                                                                                      SHA256

                                                                                      e3aec3f18bc7786c0cae41cbe09da003ef058d06ea3f4cbc8fdffaefd3aefa47

                                                                                      SHA512

                                                                                      3c5a2766ce5044ea77af70df8fe8b590a1635081ab12abb1fe04ef7998cbe4bedebd81654993ad8a88102256eb9e582b5f38a8fe0867178d2b2d3898b524ab19

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      8fa06ba4a0e904256cd39e887e0e2836

                                                                                      SHA1

                                                                                      8df077b3abe251a2ecccf98acf87580d7f6357d8

                                                                                      SHA256

                                                                                      17cc658d8ebfa2611b47083032cd92dad44b0957418138c222fd1796ff6c64aa

                                                                                      SHA512

                                                                                      c83b36b6e705812116ca435a7975abab2672a4e0abec4732a2419a5482595f427c0d80e9b0f3a34aebb5bef4f6abfc8cb6e78e2271ac2f35bfc6b8619ffe6ebb

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      47e10f599eb8610e823242dc3deddd69

                                                                                      SHA1

                                                                                      aad997e64b9066c9cdb8f8b23a8f07b6bab05c2a

                                                                                      SHA256

                                                                                      3fe4703ebfc85066afc375a53a9e9edb187881ce496e5b145b0406e351655934

                                                                                      SHA512

                                                                                      cd8113d4c01aac2213d765a3a84c238228cd68eaf9ac7c73cfd0b36fe89a53b956fea163556ade5c374a203d418452b5cefe99c851fdbf827e8803003b93a5f6

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      28316d14c72917bb2a5a297b378b6aec

                                                                                      SHA1

                                                                                      3296e36007378da2455db79da63e21045ee94642

                                                                                      SHA256

                                                                                      4d520cfee3ed2b0e2eaa85f43e6ee9d7f909f1bf9da8f21bbd6af6dad6295426

                                                                                      SHA512

                                                                                      eb0ecbbea077e95c9788153260a7621369f9f1e3c9937c2229d612341de19ac487c3d89404141a23e43f0ab03886aebd26f36ef1389229c302c519327a0cd98f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      26a1c9ec1f6918759263598574588985

                                                                                      SHA1

                                                                                      d3fd9a0295048a110a617ce66975f099927e32aa

                                                                                      SHA256

                                                                                      2cbee6e50684bfd0b0a1083454e32f604a699dc80485f08dcf73c5cf3ca82c94

                                                                                      SHA512

                                                                                      168fe1d27638153493a4543237be5076c35a22a23f21230d8d63f6a4ea5771f68fa9e47896ac09bc359b4351a147ca8006bf157d6c345562e824bedd1ddb7e6f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      ece4d3874c0aa0c82c161bd31bfca04a

                                                                                      SHA1

                                                                                      7117ad019003eeb25a06fdbbf0a3f1d11951700e

                                                                                      SHA256

                                                                                      e62ad0365d9c2aa0603cd1de1ee21608d305c1f6e30520ed728aa037c5818d8c

                                                                                      SHA512

                                                                                      eb878fb5e7e1a01bca04f8b7dd0e0c587d785c14371db5e84272782806eba381af570e82ba36fe78a3af2ea923ba5884a31da4bfabae353a3d9e47a14f660708

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578cfe.TMP

                                                                                      Filesize

                                                                                      874B

                                                                                      MD5

                                                                                      6296af4d7616978472d4db95770d1bcd

                                                                                      SHA1

                                                                                      41cab94ae4af02b6b83b5d4b8c79bc8e04390882

                                                                                      SHA256

                                                                                      bfd82abc0310dcad87435565dc45125d4de4f152d28aaddf67d29f030a2abb63

                                                                                      SHA512

                                                                                      7e712eb6d07f8dd398c1498a961914ddac17007ba8332d7614302411f347baae3d3d79912aabac467f2d396824266a9ae088b3de3b9ac337863180a7404bc193

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                      Filesize

                                                                                      16B

                                                                                      MD5

                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                      SHA1

                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                      SHA256

                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                      SHA512

                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      fb6a10ae3ded6e614bc95a8b792b5d96

                                                                                      SHA1

                                                                                      15a88d956f91565d4b5f4d182b7183629a59dfe1

                                                                                      SHA256

                                                                                      c8ada9b2e715d354ec4cfa74cdbb4632004c087daefd1a4d9321e91319e36a68

                                                                                      SHA512

                                                                                      9bfe2862fc62963f0806577e6ee4368fc4103f08e6f77d113d7b2b7b6608c2a392c38be7faa0b9bba0b4902b18614a75a96cf02ebc7ddeb9b6f02e1e090d11b4

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      12KB

                                                                                      MD5

                                                                                      2ca2ff69164c542b3cacb78726cebb99

                                                                                      SHA1

                                                                                      ea3432b54242711741a9d31335263a17b6c10b44

                                                                                      SHA256

                                                                                      9efcef1c8493926917b7f28ecbace89cab558f31bd98fe4aed8ffa1b039b358f

                                                                                      SHA512

                                                                                      bf1c4d5b764a8e5b9b836b537c8b386d9b448183dc8bec4d3402b4747fad1a5c18739a9754383e545fd341bec743a7dbf9611a59e89f07a488443ad2fa9ee6f3

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      12KB

                                                                                      MD5

                                                                                      1c63f945d94f9b23f8c97eeed04e5b2c

                                                                                      SHA1

                                                                                      d42a2b1eae1e485edc2599a448bca2c021bca9ca

                                                                                      SHA256

                                                                                      e486f0a75d8502b4390bd54e2b91b10a02d7d07bac28b723cc55b8527364b8ed

                                                                                      SHA512

                                                                                      433e63260dcba4bb5ec39a8c4c7d5cca02e353baab66af980859c187f4db89d636cbad10925bf95245d7edf65cd83d44e993cb9356989efcfe28b68695280a5f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      12KB

                                                                                      MD5

                                                                                      8d52eb2a6a4aedc03387fcd384320703

                                                                                      SHA1

                                                                                      930b3372e91471e0df754812efd956b5e8d11347

                                                                                      SHA256

                                                                                      8776a9d0c4db5364423000e1f9028348faf277ac66c946df1c9bd251d71ac158

                                                                                      SHA512

                                                                                      4bf5d28281788b42dd1bbb3962c4a60a552ca08bda0f5c29b48a056f62e0c2e65bd2235c63e0a15bc054b78d6a7cb001663d7e8a5dc1af3615a22809f2085fcf

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                      Filesize

                                                                                      12KB

                                                                                      MD5

                                                                                      d9b78a6a1ed7b40e08875a3b23c99668

                                                                                      SHA1

                                                                                      f7380e84d38153d4d9e7f904312bd0565f7c89e9

                                                                                      SHA256

                                                                                      cae585ce6cd970609c6d5e7f8baa11f9a117a92512f970a4c4d547f14595a0bb

                                                                                      SHA512

                                                                                      6249ccdda0b3421b85bae7095c0041f0b64613c56461fd2b5cc8c99042c5ff5866ece45ca6ee11d7f830d405fd3006d5771d1ee5280ebf65c03fabf09a2d32fc

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                                                                      Filesize

                                                                                      768KB

                                                                                      MD5

                                                                                      c48a0af74a192dbf62b47b4c39f4d591

                                                                                      SHA1

                                                                                      f04df512ff97ef6f69e48235b61ae510d60897a5

                                                                                      SHA256

                                                                                      22ea8f9b6d0e011986338635712d339e710cb17acb8dec9a01d7aca0848ca640

                                                                                      SHA512

                                                                                      9fcd0bff7892675d78e391f345ded606f6a39782ef6f075ea8fcc84ee3768cf0f43873c049178c71444bd1ccc05eeab4f6282d2d3406fa08af43e867427a2dee

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                                                                      Filesize

                                                                                      1024KB

                                                                                      MD5

                                                                                      cee7bebba6acf6c834080ccbb15322cc

                                                                                      SHA1

                                                                                      f39a8bb4f0dc34984b3eda5aff1f42b7545bd927

                                                                                      SHA256

                                                                                      5d7c35e5501cb31c84a9094212521c754a19d39e2c655d31db5d6ea95f3a89a9

                                                                                      SHA512

                                                                                      b010a866d5bf928df69a7f6e59c0fe891ee8a02c5e38dc6458879f3081a3be368fa79fe0ae6535be28eab9ec587401109fedb8b50389b19c73cfe0d710171588

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      7050d5ae8acfbe560fa11073fef8185d

                                                                                      SHA1

                                                                                      5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                      SHA256

                                                                                      cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                      SHA512

                                                                                      a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                    • C:\Users\Admin\Downloads\437cd0bf-cba8-4a49-9cf0-ab2ecea99956.tmp

                                                                                      Filesize

                                                                                      3.0MB

                                                                                      MD5

                                                                                      b6d61b516d41e209b207b41d91e3b90d

                                                                                      SHA1

                                                                                      e50d4b7bf005075cb63d6bd9ad48c92a00ee9444

                                                                                      SHA256

                                                                                      3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe

                                                                                      SHA512

                                                                                      3217fc904e4c71b399dd273786634a6a6c19064a9bf96960df9b3357001c12b9547813412173149f6185eb5d300492d290342ec955a8347c6f9dcac338c136da

                                                                                    • C:\Users\Admin\Downloads\AxInterop.ShockwaveFlashObjects.dll:Zone.Identifier

                                                                                      Filesize

                                                                                      55B

                                                                                      MD5

                                                                                      0f98a5550abe0fb880568b1480c96a1c

                                                                                      SHA1

                                                                                      d2ce9f7057b201d31f79f3aee2225d89f36be07d

                                                                                      SHA256

                                                                                      2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

                                                                                      SHA512

                                                                                      dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 103769.crdownload

                                                                                      Filesize

                                                                                      129KB

                                                                                      MD5

                                                                                      0ec108e32c12ca7648254cf9718ad8d5

                                                                                      SHA1

                                                                                      78e07f54eeb6af5191c744ebb8da83dad895eca1

                                                                                      SHA256

                                                                                      48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

                                                                                      SHA512

                                                                                      1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 313905.crdownload

                                                                                      Filesize

                                                                                      248KB

                                                                                      MD5

                                                                                      20d2c71d6d9daf4499ffc4a5d164f1c3

                                                                                      SHA1

                                                                                      38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

                                                                                      SHA256

                                                                                      3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

                                                                                      SHA512

                                                                                      8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 313905.crdownload:SmartScreen

                                                                                      Filesize

                                                                                      7B

                                                                                      MD5

                                                                                      4047530ecbc0170039e76fe1657bdb01

                                                                                      SHA1

                                                                                      32db7d5e662ebccdd1d71de285f907e3a1c68ac5

                                                                                      SHA256

                                                                                      82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

                                                                                      SHA512

                                                                                      8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 359802.crdownload

                                                                                      Filesize

                                                                                      17KB

                                                                                      MD5

                                                                                      451112d955af4fe3c0d00f303d811d20

                                                                                      SHA1

                                                                                      1619c35078ba891091de6444099a69ef364e0c10

                                                                                      SHA256

                                                                                      0d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9

                                                                                      SHA512

                                                                                      35357d2c4b8229ef9927fa37d85e22f3ae26606f577c4c4655b2126f0ecea4c69dae03043927207ca426cc3cd54fc3e72124369418932e04733a368c9316cf87

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 676929.crdownload

                                                                                      Filesize

                                                                                      21KB

                                                                                      MD5

                                                                                      e869d1d4545c212d9068a090a370ded3

                                                                                      SHA1

                                                                                      a6a92f108bba390cd14e7103ba710efec1d270f9

                                                                                      SHA256

                                                                                      63af704211a03f6ff6530ebfca095b6c97636ab66e5a6de80d167b19c3c30c66

                                                                                      SHA512

                                                                                      ee108b0ebefb476c5beb568129da7ce058229fb42ad3500c6fc37a36d718eb67a17b331d73f6920a5290c3977be2eda96aa057533c3344898d161cb464c6ef76

                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 706349.crdownload

                                                                                      Filesize

                                                                                      4.4MB

                                                                                      MD5

                                                                                      6a4853cd0584dc90067e15afb43c4962

                                                                                      SHA1

                                                                                      ae59bbb123e98dc8379d08887f83d7e52b1b47fc

                                                                                      SHA256

                                                                                      ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

                                                                                      SHA512

                                                                                      feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

                                                                                    • C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier

                                                                                      Filesize

                                                                                      26B

                                                                                      MD5

                                                                                      fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                      SHA1

                                                                                      d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                      SHA256

                                                                                      eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                      SHA512

                                                                                      aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                    • C:\Users\Admin\Downloads\chilledwindows.mp4

                                                                                      Filesize

                                                                                      3.6MB

                                                                                      MD5

                                                                                      698ddcaec1edcf1245807627884edf9c

                                                                                      SHA1

                                                                                      c7fcbeaa2aadffaf807c096c51fb14c47003ac20

                                                                                      SHA256

                                                                                      cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

                                                                                      SHA512

                                                                                      a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

                                                                                    • memory/1664-800-0x0000000001A70000-0x0000000001A80000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/1664-798-0x0000000001A70000-0x0000000001A80000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/1664-761-0x0000000001A70000-0x0000000001A80000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/1664-797-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/1664-805-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/1664-759-0x0000000001A70000-0x0000000001A80000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/1664-758-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/1956-301-0x0000000005810000-0x0000000005820000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/1956-297-0x0000000074B30000-0x00000000752E1000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/1956-296-0x0000000000A50000-0x0000000000AC2000-memory.dmp

                                                                                      Filesize

                                                                                      456KB

                                                                                    • memory/1956-298-0x00000000055C0000-0x000000000565C000-memory.dmp

                                                                                      Filesize

                                                                                      624KB

                                                                                    • memory/1956-299-0x0000000005C10000-0x00000000061B6000-memory.dmp

                                                                                      Filesize

                                                                                      5.6MB

                                                                                    • memory/1956-300-0x0000000005660000-0x00000000056F2000-memory.dmp

                                                                                      Filesize

                                                                                      584KB

                                                                                    • memory/1956-302-0x0000000005560000-0x000000000556A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/1956-303-0x0000000005760000-0x00000000057B6000-memory.dmp

                                                                                      Filesize

                                                                                      344KB

                                                                                    • memory/1956-304-0x0000000074B30000-0x00000000752E1000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/2308-683-0x000000001BC90000-0x000000001BCA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/2308-686-0x0000000021FB0000-0x0000000021FE8000-memory.dmp

                                                                                      Filesize

                                                                                      224KB

                                                                                    • memory/2308-739-0x000000001BC90000-0x000000001BCA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/2308-738-0x000000001BC90000-0x000000001BCA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/2308-736-0x000000001BC90000-0x000000001BCA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/2308-735-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2308-687-0x000000001CA50000-0x000000001CA5E000-memory.dmp

                                                                                      Filesize

                                                                                      56KB

                                                                                    • memory/2308-670-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2308-671-0x000000001BC90000-0x000000001BCA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/2308-753-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2308-669-0x0000000000AC0000-0x0000000000F24000-memory.dmp

                                                                                      Filesize

                                                                                      4.4MB

                                                                                    • memory/2308-685-0x0000000003330000-0x0000000003338000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/2308-672-0x000000001BC90000-0x000000001BCA0000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/3976-884-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/4636-551-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                                                      Filesize

                                                                                      664KB

                                                                                    • memory/4636-538-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4744-812-0x0000000074A10000-0x00000000751C1000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/4744-808-0x0000000074A10000-0x00000000751C1000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/4744-809-0x0000000005850000-0x0000000005860000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4780-1025-0x000000001D000000-0x000000001D04C000-memory.dmp

                                                                                      Filesize

                                                                                      304KB

                                                                                    • memory/4780-1026-0x0000000001AF0000-0x0000000001B00000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4780-1013-0x000000001CDA0000-0x000000001CE3C000-memory.dmp

                                                                                      Filesize

                                                                                      624KB

                                                                                    • memory/4780-1014-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

                                                                                      Filesize

                                                                                      9.6MB

                                                                                    • memory/4780-1012-0x000000001C800000-0x000000001CCCE000-memory.dmp

                                                                                      Filesize

                                                                                      4.8MB

                                                                                    • memory/4780-1024-0x0000000001C50000-0x0000000001C58000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/4780-1010-0x000000001C260000-0x000000001C306000-memory.dmp

                                                                                      Filesize

                                                                                      664KB

                                                                                    • memory/4780-1011-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

                                                                                      Filesize

                                                                                      9.6MB

                                                                                    • memory/4780-1169-0x0000000001AF0000-0x0000000001B00000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4780-1168-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

                                                                                      Filesize

                                                                                      9.6MB

                                                                                    • memory/4780-1166-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

                                                                                      Filesize

                                                                                      9.6MB

                                                                                    • memory/4920-455-0x0000000074BD0000-0x0000000075381000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB

                                                                                    • memory/4920-456-0x0000000005A20000-0x0000000005A30000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                    • memory/4920-459-0x0000000005A10000-0x0000000005A1A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                    • memory/4920-460-0x0000000074BD0000-0x0000000075381000-memory.dmp

                                                                                      Filesize

                                                                                      7.7MB