badrabbit | hxxps://www[.]google[.]com/search?q=how+to+download+a+windows+10+iso&rlz=1C1GCEA_enUS1102US1102&oq=how+to+download+a+windows+&gs_lcrp=EgZjaHJvbWUqBwgBEAAYgAQyBwgAEAAYgAQyBwgBEAAYgAQyBwgCEAAYgAQyBggDEEUYOTIHCAQQABiABDIHCAUQABiABDIHCAYQABiABDIHCAcQABiABDIHCAgQABiABDIHCAkQABiABNIBCDc4NjZqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&safe=active&ssui=on

Resubmissions

17-04-2024 14:27

240417-rsxa7sdd6x 10

17-04-2024 14:17

240417-rl6lasbe47 8

Analysis

max time kernel
1172s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/search?q=how+to+download+a+windows+10+iso&rlz=1C1GCEA_enUS1102US1102&oq=how+to+download+a+windows+&gs_lcrp=EgZjaHJvbWUqBwgBEAAYgAQyBwgAEAAYgAQyBwgBEAAYgAQyBwgCEAAYgAQyBggDEEUYOTIHCAQQABiABDIHCAUQABiABDIHCAYQABiABDIHCAcQABiABDIHCAgQABiABDIHCAkQABiABNIBCDc4NjZqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&safe=active&ssui=on

Score

10^/10

badrabbit mimikatz revengerat wannacry guest bootkit persistence ransomware spyware stealer trojan worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x000b000000023555-992.dat	revengerat

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023546-835.dat	mimikatz

Blocklisted process makes network request 28 IoCs

flow	pid	Process
722	5224	rundll32.exe
746	5224	rundll32.exe
797	5224	rundll32.exe
821	5224	rundll32.exe
857	5224	rundll32.exe
888	5224	rundll32.exe
916	5224	rundll32.exe
951	5224	rundll32.exe
993	5224	rundll32.exe
1033	5224	rundll32.exe
1065	5224	rundll32.exe
1093	5224	rundll32.exe
1130	5224	rundll32.exe
1171	5224	rundll32.exe
1212	5224	rundll32.exe
1242	5224	rundll32.exe
1269	5224	rundll32.exe
1308	5224	rundll32.exe
1349	5224	rundll32.exe
1384	5224	rundll32.exe
1409	5224	rundll32.exe
1444	5224	rundll32.exe
1485	5224	rundll32.exe
1526	5224	rundll32.exe
1560	5224	rundll32.exe
1586	5224	rundll32.exe
1621	5224	rundll32.exe
1663	5224	rundll32.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD7A10.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD7A17.tmp	WannaCry.exe

Executes dropped EXE 27 IoCs

pid	Process
3964	Alerta.exe
1432	Amus.exe
968	BadRabbit.exe
5356	CF7B.tmp
4280	Bezilom.exe
5496	MEMZ.exe
3600	MEMZ.exe
5888	MEMZ.exe
2020	MEMZ.exe
920	MEMZ.exe
4052	MEMZ.exe
5952	MEMZ.exe
5260	Time.exe
3784	Time.exe
5436	Time.exe
6132	Time.exe
2312	RevengeRAT.exe
5312	WannaCry.exe
5284	!WannaDecryptor!.exe
2312	WindowsUpdate.exe
6112	RevengeRAT.exe
2552	Time.exe
5924	!WannaDecryptor!.exe
4904	!WannaDecryptor!.exe
5012	!WannaDecryptor!.exe
3960	TaskILL.exe
5500	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
5224	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microzoft_Ofiz = "C:\\Windows\\KdzEregli.exe"	Amus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartUp = "C:\\Windows\\Maria.doc .exe"	Bezilom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	RegSvcs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
120	raw.githubusercontent.com
121	raw.githubusercontent.com
400	0.tcp.ngrok.io
506	0.tcp.ngrok.io
528	0.tcp.ngrok.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 5052	2312	RevengeRAT.exe	208
PID 5052 set thread context of 5784	5052	RegSvcs.exe	209
PID 6112 set thread context of 2268	6112	RevengeRAT.exe	234
PID 2268 set thread context of 1588	2268	RegSvcs.exe	235
PID 5500 set thread context of 2700	5500	svchost.exe	322
PID 2700 set thread context of 1500	2700	RegSvcs.exe	323

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Meydanbasi.exe	Amus.exe
File opened for modification	C:\Windows\CF7B.tmp	rundll32.exe
File opened for modification	C:\Windows\KdzEregli.exe	Amus.exe
File opened for modification	C:\Windows\Pire.exe	Amus.exe
File created	C:\Windows\KdzEregli.exe	Amus.exe
File created	C:\Windows\Pide.exe	Amus.exe
File opened for modification	C:\Windows\My_Pictures.exe	Amus.exe
File created	C:\Windows\Pire.exe	Amus.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\My_Pictures.exe	Amus.exe
File opened for modification	C:\Windows\Cekirge.exe	Amus.exe
File created	C:\Windows\Ankara.exe	Amus.exe
File created	C:\Windows\Anti_Virus.exe	Amus.exe
File opened for modification	C:\Windows\Anti_Virus.exe	Amus.exe
File created	C:\Windows\Maria.doc .exe	Bezilom.exe
File created	C:\Windows\Messenger.exe	Amus.exe
File opened for modification	C:\Windows\Ankara.exe	Amus.exe
File created	C:\Windows\Adapazari.exe	Amus.exe
File created	C:\Windows\Meydanbasi.exe	Amus.exe
File opened for modification	C:\Windows\Maria.doc .exe	Bezilom.exe
File opened for modification	C:\Windows\Adapazari.exe	Amus.exe
File opened for modification	C:\Windows\Pide.exe	Amus.exe
File created	C:\Windows\Cekirge.exe	Amus.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\Messenger.exe	Amus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3388	schtasks.exe
5752	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
5644	taskkill.exe
4768	taskkill.exe
5684	taskkill.exe
5740	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2288054676-1871194608-3559553667-1000\{B90159F4-FE26-4221-BC03-8CC6BC081BE5}	msedge.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 830233.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 86344.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 774368.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 332308.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 274184.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 918014.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 383655.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 944025.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 530259.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 562892.crdownload:SmartScreen	msedge.exe
File created	C:\svchost\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
1236	msedge.exe
1236	msedge.exe
512	identity_helper.exe
512	identity_helper.exe
2284	msedge.exe
2284	msedge.exe
5884	msedge.exe
5884	msedge.exe
5972	msedge.exe
5972	msedge.exe
5352	msedge.exe
5352	msedge.exe
1784	msedge.exe
1784	msedge.exe
3500	msedge.exe
3500	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
6124	msedge.exe
6124	msedge.exe
588	msedge.exe
588	msedge.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5356	CF7B.tmp
5356	CF7B.tmp
5356	CF7B.tmp
5356	CF7B.tmp
5356	CF7B.tmp
5356	CF7B.tmp
5356	CF7B.tmp
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
5888	MEMZ.exe
5888	MEMZ.exe
5888	MEMZ.exe
5888	MEMZ.exe
920	MEMZ.exe
920	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
3600	MEMZ.exe
920	MEMZ.exe
920	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
5888	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5952	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1416	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1416	AUDIODG.EXE
Token: SeShutdownPrivilege	5224	rundll32.exe
Token: SeDebugPrivilege	5224	rundll32.exe
Token: SeTcbPrivilege	5224	rundll32.exe
Token: SeDebugPrivilege	5356	CF7B.tmp
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeDebugPrivilege	2312	RevengeRAT.exe
Token: SeDebugPrivilege	5052	RegSvcs.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	5684	taskkill.exe
Token: SeDebugPrivilege	5740	taskkill.exe
Token: SeDebugPrivilege	5644	taskkill.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeDebugPrivilege	6112	RevengeRAT.exe
Token: SeDebugPrivilege	2268	RegSvcs.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeDebugPrivilege	3960	TaskILL.exe
Token: SeDebugPrivilege	5500	svchost.exe
Token: SeDebugPrivilege	2700	RegSvcs.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe
Token: SeSystemtimePrivilege	5436	Time.exe
Token: SeSystemtimePrivilege	6132	Time.exe
Token: SeSystemtimePrivilege	5260	Time.exe
Token: SeSystemtimePrivilege	3784	Time.exe
Token: SeSystemtimePrivilege	2552	Time.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
2312	WindowsUpdate.exe
2312	WindowsUpdate.exe
2312	WindowsUpdate.exe
2312	WindowsUpdate.exe
2312	WindowsUpdate.exe
2312	WindowsUpdate.exe
2312	WindowsUpdate.exe
2312	WindowsUpdate.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1432	Amus.exe
4280	Bezilom.exe
5496	MEMZ.exe
3600	MEMZ.exe
5888	MEMZ.exe
2020	MEMZ.exe
920	MEMZ.exe
4052	MEMZ.exe
5952	MEMZ.exe
5284	!WannaDecryptor!.exe
5284	!WannaDecryptor!.exe
5924	!WannaDecryptor!.exe
5924	!WannaDecryptor!.exe
4904	!WannaDecryptor!.exe
4904	!WannaDecryptor!.exe
5012	!WannaDecryptor!.exe
5012	!WannaDecryptor!.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe
5952	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 508	1236	msedge.exe	83
PID 1236 wrote to memory of 508	1236	msedge.exe	83
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 3044	1236	msedge.exe	85
PID 1236 wrote to memory of 4164	1236	msedge.exe	86
PID 1236 wrote to memory of 4164	1236	msedge.exe	86
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87
PID 1236 wrote to memory of 2676	1236	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+download+a+windows+10+iso&rlz=1C1GCEA_enUS1102US1102&oq=how+to+download+a+windows+&gs_lcrp=EgZjaHJvbWUqBwgBEAAYgAQyBwgAEAAYgAQyBwgBEAAYgAQyBwgCEAAYgAQyBggDEEUYOTIHCAQQABiABDIHCAUQABiABDIHCAYQABiABDIHCAcQABiABDIHCAgQABiABDIHCAkQABiABNIBCDc4NjZqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&safe=active&ssui=on
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe44d946f8,0x7ffe44d94708,0x7ffe44d94718
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1608 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1700 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1700 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2236 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1476
- C:\Users\Admin\Downloads\Time.exe
  "C:\Users\Admin\Downloads\Time.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:5316
- C:\Users\Admin\Downloads\Time.exe
  "C:\Users\Admin\Downloads\Time.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:4632
- C:\Users\Admin\Downloads\Time.exe
  "C:\Users\Admin\Downloads\Time.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5436
- C:\Users\Admin\Downloads\Time.exe
  "C:\Users\Admin\Downloads\Time.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6132
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5784
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-suy27i0.cmdline"
      4⤵
      PID:5792
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\unmfa0mj.cmdline"
      4⤵
      PID:2992
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4A9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC2AB18524F7442CA24C36CAAE5EF527.TMP"
        5⤵
        
        PID:4836
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8fv6y-fs.cmdline"
      4⤵
      PID:5924
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5B2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc402CA9F3BB04E4594696E062AD3D72.TMP"
        5⤵
        
        PID:6120
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a5u2vsxl.cmdline"
      4⤵
      PID:5452
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA804.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7E4CF71AD35446249699C7F6EFDB589.TMP"
        5⤵
        
        PID:6032
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_ff1u4wn.cmdline"
      4⤵
      PID:5792
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9AA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC02943DADE44F2FB84E92B5E29AEAE5.TMP"
        5⤵
        
        PID:888
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\expbt8su.cmdline"
      4⤵
      PID:4448
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA85.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6BD9465EB3B4A3CB43B8F0671C1890.TMP"
        5⤵
        
        PID:5800
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\klfyb-b9.cmdline"
      4⤵
      PID:6112
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB9E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc596B3B2B741342A29FCBF84AE63882.TMP"
        5⤵
        
        PID:836
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rzexzxbn.cmdline"
      4⤵
      PID:372
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADA2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc911D2274E4E14A9A85C65912131CA73.TMP"
        5⤵
        
        PID:5712
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lfa8povf.cmdline"
      4⤵
      PID:844
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE8C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5CAED9B1B05040ABA1E39E19D335F628.TMP"
        5⤵
        
        PID:2492
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i6hj8gjs.cmdline"
      4⤵
      PID:2992
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFE4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCF4A0D57B4B646C78F45D1F245A922A6.TMP"
        5⤵
        
        PID:5540
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r5hrda7j.cmdline"
      4⤵
      PID:6032
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB216.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9E73431636294593ABB24C9011CF828A.TMP"
        5⤵
        
        PID:2096
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jxn_dl7u.cmdline"
      4⤵
      PID:3732
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:888
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB34F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1EE7B4B48FC04276B5A9FBB5897BA3C7.TMP"
        5⤵
        
        PID:4168
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d-sbdklb.cmdline"
      4⤵
      PID:4624
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB458.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45FA9A9AC6A346AFAF7CBBC1DDA65D9A.TMP"
        5⤵
        
        PID:1652
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fv5wdpwj.cmdline"
      4⤵
      PID:3096
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB572.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBF263D3C1FB4725AB3D38B9E709BAF.TMP"
        5⤵
        
        PID:5360
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wjs8v2hv.cmdline"
      4⤵
      PID:4956
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2096
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB67B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEA2D577C4CC44E2D9D5111BBFDCAB77A.TMP"
        5⤵
        
        PID:5304
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xm2e9xwe.cmdline"
      4⤵
      PID:4168
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7A4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3A3B361780094BD4BF80597A8375461.TMP"
        5⤵
        
        PID:2296
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jogdu_v7.cmdline"
      4⤵
      PID:5112
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6CC68E7843B4BADB7FF19851359EE7F.TMP"
        5⤵
        
        PID:5500
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wrwfyeaj.cmdline"
      4⤵
      PID:5544
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9E6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7ACA34D39F014522AE67EEC49B44D7F3.TMP"
        5⤵
        
        PID:5016
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tiiqtzyo.cmdline"
      4⤵
      PID:5348
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB4E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc635FD0D9685C4F7F8E664C7D66AEE4D3.TMP"
        5⤵
        
        PID:372
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yqlfgsze.cmdline"
      4⤵
      PID:3048
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4168
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC86.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5BDD2A6F6084A5986313211FFBD41CD.TMP"
        5⤵
        
        PID:5668
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rerpoics.cmdline"
      4⤵
      PID:1652
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD70.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4AD6F4DB51BF4F5C85CAD37BAB334DA7.TMP"
        5⤵
        
        PID:6008
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sqqop4x5.cmdline"
      4⤵
      PID:2900
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC020.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0DA85DFCB9D433E934D1E5D4659FDA.TMP"
        5⤵
        
        PID:5364
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8mhwdclj.cmdline"
      4⤵
      PID:2256
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5348
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC10A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc708BDD8A8E943808BA9102DD36DAE1A.TMP"
        5⤵
        
        PID:4396
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pms5qeyk.cmdline"
      4⤵
      PID:4888
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3048
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC224.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc732FC89E6AA94E2787EBCBD5D5DDFE77.TMP"
        5⤵
        
        PID:2488
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8hzoy6yq.cmdline"
      4⤵
      PID:5256
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC35C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE44FE19930D34EFABCD789562DC8F9C0.TMP"
        5⤵
        
        PID:1288
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9fi6lgxe.cmdline"
      4⤵
      PID:3076
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2900
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:5500
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        6⤵
        
        PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8288 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11262391635847171411,2065890191787997340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:1
  2⤵
  PID:6032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3832

C:\Users\Admin\Downloads\Alerta.exe
"C:\Users\Admin\Downloads\Alerta.exe"
1⤵
- Executes dropped EXE
PID:3964

C:\Users\Admin\Downloads\Amus.exe
"C:\Users\Admin\Downloads\Amus.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1432

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5224
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:4552
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:5892
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3564408997 && exit"
    3⤵
    PID:3236
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3564408997 && exit"
      4⤵
      Creates scheduled task(s)
      PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:49:00
    3⤵
    PID:3680
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:49:00
      4⤵
      Creates scheduled task(s)
      PID:5752
- - C:\Windows\CF7B.tmp
    "C:\Windows\CF7B.tmp" \\.\pipe\{E1800078-0778-4F6E-8441-F4C43690130C}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5356

C:\Users\Admin\Downloads\Bezilom.exe
"C:\Users\Admin\Downloads\Bezilom.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5496
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3600
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5888
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2020
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:920
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4052
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5952
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
    3⤵
    PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe44d946f8,0x7ffe44d94708,0x7ffe44d94718
      4⤵
      PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
    3⤵
    PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe44d946f8,0x7ffe44d94708,0x7ffe44d94718
      4⤵
      PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
    3⤵
    PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe44d946f8,0x7ffe44d94708,0x7ffe44d94718
      4⤵
      PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe44d946f8,0x7ffe44d94708,0x7ffe44d94718
      4⤵
      PID:5256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5988

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:5312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 131541713336584.bat
  2⤵
  PID:5984
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    PID:3432
- C:\Users\Admin\Downloads\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Users\Admin\Downloads\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  PID:4716
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4904
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:4956
- C:\Users\Admin\Downloads\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:5012

C:\Users\Admin\Downloads\WindowsUpdate.exe
"C:\Users\Admin\Downloads\WindowsUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:2312

C:\Users\Admin\Downloads\RevengeRAT.exe
"C:\Users\Admin\Downloads\RevengeRAT.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:6112
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:1588

C:\Users\Admin\Downloads\Time.exe
"C:\Users\Admin\Downloads\Time.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Users\Admin\Downloads\TaskILL.exe
"C:\Users\Admin\Downloads\TaskILL.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3960
- C:\Windows\SYSTEM32\mountvol.exe
  mountvol c:\ /d
  2⤵
  PID:5304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost\vcredist2012_x86_1_vcRuntimeAdditional_x86.ico

Filesize
4KB

MD5
fde1b01ca49aa70922404cdfcf32a643

SHA1
b0a2002c39a37a0ccaf219d42f1075471fd8b481

SHA256
741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

SHA512
b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

Download Submit
C:\Recovery\WindowsRE\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
82de64c99df02f3804c9124d8f267989

SHA1
75985f617039ab440b0776562560c98f0c1af06f

SHA256
83bcaf3e7aad12fc7db3d94a6ac84c61ec699c055bb50df514ee445b81ce08ae

SHA512
d01fd7d4225fea51187ec0f6aed38244a5d642a223b9d680e8ad060cd86ea0a6a9ca3bbece934bca7beccb5b5bb3553d0eceaa26fce87328123ab1dac9eb01e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
198KB

MD5
319e0c36436ee0bf24476acbcc83565c

SHA1
fb2658d5791fe5b37424119557ab8cee30acdc54

SHA256
f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1

SHA512
ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f23176913048103_0

Filesize
326KB

MD5
18817535d4bd40b03bfb23d44d288663

SHA1
c7d50f270b9d2082bfd8e73dea2860e2d26551b9

SHA256
051a9d10c41bbeb9c642dcd6414d688be6c0b7057987aba811d1bd378c06075d

SHA512
6a9c740ac8d5c7be08f7a6383a4bd900f09461cff5723fc1f3063744932427890573bff9c27b2027909e1b789461e8ea25ea63841582716b6cf4b1452f5a42fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\80089a7b3438c897_0

Filesize
289B

MD5
6d9233fa528cd7a9dd27e5a1050f2a76

SHA1
709dae5317e89542e714736f2f890d4583539ef7

SHA256
dc4d007a5e62ce73c27d3dd8dc0ec6339fea756f90f75fa4db78d0bd1b30b99b

SHA512
c4d0f3be2845775b6bb0f20f80fa068c976ee6045696dc45e4099070a07c88d3fb0e17027b6714058ec0fc5cb57fb1d22d165bd065eea284b98c825be696fb4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
abbecdf97e5ada983f9664d770d97e5d

SHA1
aff74de2a9c740366aee93a5f4ce3b7fa8f6224d

SHA256
989b07d0c2ccce573d70a086bf2d4f85c7a81172e9e4f0fdab4df7d05b2ef212

SHA512
6c8e2d7f642f044e9852fc206ae1715b81dae610ab4f82d3c1e71b3f583daaa550f52a490060e8cbeab23267a409673e5a3e06dd645ec1cf610270a23f865ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e1997b9083e014df737dad5182560dd3

SHA1
6869bdf95d361a2628b5225f7c5aeb002ddb16a9

SHA256
b8432716cfc54a6a0efa6a64905f9ed2179716aa2bc7b2b636bd1df0493a0c87

SHA512
3f152fc26fb5360fb567fd40925802b9cbdef56aba31914b1e1e7121571bd540bce684770cf8a7c0257240d2948f84f1722ad7c648304e23a9b00d829f897bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
103f2c9fc182a45287b6be4f774c7554

SHA1
97744a6ce6e942120fade2306b0e39376165ddf5

SHA256
e76721c4f94d719522314d81faa80cc3c10a7f2b29156931a91a3ee167caa3d7

SHA512
29ed69576d13f94fbc2cdb94c29f09391d1deaca320bf052e9fd86776c6d5e2becfed53b94fdb319f4652c4b7dc32b523141d1bc1148959582000091fa34789e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.vice.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
058a69b4a814d8c938d5b49c0b066f2f

SHA1
ab4e11ac2099d182ce009ec20f613d56c255473c

SHA256
5140674277b4c0a80553056eecbe276d58be820e60dd1e1ebdc717a1e3a119b6

SHA512
1692d289fae79ee5d433aa1520a48b92bf593c58f8ec13ffb90e855cfb3d7b64bceeec175f7ca285f517ad5c8040898dc61ef3141d5e6e4aa2978de86f4aa959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ed49ecaa135929eb1f54564bfd785c4c

SHA1
79920a1962bd32f87ed4d001728f86971cb38c30

SHA256
ff37186c0728ee873ce94475e63395d4734f45b475d07f140865f8978dc7c188

SHA512
fd85e5aa2584efa4c596b872158066d545f6d5793e11514a1b4835ac3025f6fe10e5e0697da0468a769fb57e2576edab2414fa94debd7628b1377d0c46d327dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a79638e0b3aa931690a63415d940bf60

SHA1
25b64ab92a484eeb242c0a62ab7f3d3288603125

SHA256
505d01b1c758949c6899edc6bee30e1c7380a85f891b906cfa76345a055097d2

SHA512
5f232463c098024d39663e5ed65f904c661fbfd862e44027e670bad620f02778f9615aecc34f56b6ab63a11a9d4d6adf8dddd9569ee85ab5c75fe56488852e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e43ed9cf0b0a9648b78aeb5752d3f31f

SHA1
3e45a29b96e9ca6ecc0641cbc96726343544b1c9

SHA256
545737da721af2133c6f390f56a2eb107ac59971836f117bd1cf455daf5d07e7

SHA512
589377a8a9e525cd9708304a8b333d28d7043ab7d3c7d71287390cf7987d22db484035776edf0577c5bd142e3e24e6e7bfd4ed795b355b4bfb5254be0f57e73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
a40f8cff8d80398d290f24bdf3fda558

SHA1
73c5e7118690547a07ee75131701eeeeced5256d

SHA256
269ca29330b15bffb6ae3dfe837d4412d8a5f99dc1ce5e34d3889299368efef2

SHA512
0b7806a99830764b0e451d2a15d3e0e8c0a5bd7516ad0b5abcca7d907fcad4ff058d74b4668174899ab337912c221ffe2dceac9dd82846b244b71af80b4142d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
272be2fe2c791943f130908c38de371a

SHA1
212a9410a94d695e39085d43effd37bedba61286

SHA256
5804e678d790ecf498e4fc0ec91db093ab4417591fe789905d22932bd212f555

SHA512
709ddda93055fe907b4badf63c08eb18616e09b2239fe9230a83c7ffccb7643f5da98144a87e164b904d1630e426da5d2bbe5deff5b58fdc50b09d60f017a7cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
633fb5fc33566afe09daeec5097e5fd4

SHA1
a616facfd1a34dc3382263421bc06232aed507ea

SHA256
ab21580c476ac88b9a5d8e120c38c82e466b48cf37ebc0a1d7c412d03f3a5a8c

SHA512
f2ed728d84afbab52336c5f3813a7dd6bac1b66cfaed88aa9b86eae56f9cc53ddc38caeed1d517246740df5e660498dfc3d3cf59a230e9171408f65836fad449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ebccb39d9e106c87e3e469de0f546142

SHA1
61b694dd287db636b91389a2b1e920eeef6a19d3

SHA256
b6b086fcee405d9693b36835aab1f8ca410c9e1a94ac4acc1cb13d5e762b7586

SHA512
d02df4b35724d9fef2394189a58bf29b52b0a36270c3c65df46e314dcc71b54ba2c7602e223e428b2d6cb430d92912df39e03ffecaf08248e47129507cb2f240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
25027e5bfa466688e2691ae6cea80cc1

SHA1
4f7c48ffdcf67d8207299491715b8fcce57b1a14

SHA256
ad559ba2e8dd339e84968ee104460a99793c58669798ae55606e9f37382d4627

SHA512
ea02cfdb32b4db861f38f990641d2bc7f80576bf4c344a4fc9178b3555209b6381be423b757d12630678a6e12812c5bd232e79e3272875389f0ede1c3d91f0b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
038482a3540ab535fdcc5ca9939a954b

SHA1
c315a824ad1683db91dfff665d66b2fd53df7a95

SHA256
00e792269685d54b8f6201772287e4a8c928f4757c96016a34643a93ccdd979e

SHA512
bfc59ceae969a8c717414acbddeae27dc4778899365aa1aec32b3268a5407abeec2e8c115c4024521ae1da6a067a56ed0c279a5629f47e3fdfb7160b2d031111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e353de9aaf149d4122c5810cbe56f67

SHA1
b9c8f21efa43d9d15a0506b3bfc17962ea96da86

SHA256
ffbc732d760dae32bf9511f29e2e762e167a966afb0530220d3184413b170728

SHA512
bdadfa5ff95db16b101c11f71057dc8f648721b6b59052332bd63b6ab2338663d3eba57d5974e1bb44343d19965d00a98d9665abc99aa3638de6c88248f1e40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e0a90f495a987e8a73b23c538e043db9

SHA1
dec0c240374708930367fe773eef9290441c4e93

SHA256
34a65297b8b66a0469d7ee656e4695babb9059e8603a84c5ae4b09814992a375

SHA512
63da0dfdaff17edf947184f21fb6e417d1d1ef843dee9e3540dcec0d1b485d289d5e47e7a85072010e3b6b1bfdebae56f8a0702eca0c7249a5d27817bc28a777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2228d5782b1256470b52fe1cce110805

SHA1
58dc070f4a456b53f1d2598130223d03f1662300

SHA256
733ff7b2c9b64597b114492335c421f2c2e04166c75ee60be75baed7679d1f7b

SHA512
fe6fda316a20e3f74eecad0135c8c010f83677336acefbf048aed983464a0b979de82ee3d9b00e79ac449c967f61230abdeef53c53dba532e5a6bee6520babb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
66d2a8233e5b216d046edc0b295a6e2c

SHA1
728b3055fd03c67f48ece8027258e898a0d4667e

SHA256
c84ff4064ff38aa81598f489d527ba4c88642862487508225fbad1f707f6d60a

SHA512
603f9313de6d499574cb57f98605cb21de46282e4ea3576ea571d800d4bfab30445b08c372e5c1a73fe28917cd662eb8336d42b9781f4f89679923507403159c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
defd9844e7ead24624f385c2e4361db4

SHA1
a8572d9465aad76472d5ec5f97ea1eefe5e22dbb

SHA256
570656816ce0f088a520e4dd53ca961cb3816ceeca69900ec1d6b45a527f6655

SHA512
b53c27d3e5465cfea9f409792a3ed8996445b8f4a34cba58b2b1f522a7f416a8bd49b6a7710e98791fa245cd9d53d975dd38fe21551ebba9937127ff775ce7a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab6cbd30361900ff1b7665f4d7a5f00b

SHA1
5a84f33f20a706bef809d821147d20c40e9f7306

SHA256
400e294696bef14172d6215d82b7e4ab21f9a809d36ba38ecda726e1d86efb19

SHA512
2f83f50749b1c4dd41e753c73128c9ac9125bf78fd22e499c2ed0ded53da436638029187e4dd2e2db6ddbdd27d82f86ab6c187f4b8a1905bdecd55abcff76bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
897a1ef050e14c8312855aabd81503f7

SHA1
9bce7cdbb571fc286122efd41ab05245fe404814

SHA256
45b978f29f0c379711d206f78564176e4a0cf3544faf5eb2f2cb06149253df1f

SHA512
7491b98774ab8624dbb918c3321bbe053c24920543df97ff75edc9f47c3770288de0b31911e23ffc3c110b1348f21bc49a0fc86712c37545986b1acac6ea05f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e3264fef7b59e9f0c1128d648b2e998c

SHA1
5a43b308506afa6fa08c9a8c7bffaba4d78b79f9

SHA256
61ce0a6a4d6c02dd36ce846148214d4aeb2bacf2524153d3e6ce2a78cc3c3f99

SHA512
0028a00d13fbaabff0db04c3e0602cb593132cd5dce71757a0a5d6d6858270e855bf9bd0815f5d055ea87e7f5ae0bc882489e947b6145cd8ae1ec3643bbd09a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7ec679806dd8becfc740f38ec39e9047

SHA1
4818957a6d7676a1f120ee6f234a37098b6d2544

SHA256
d09e25256bf3a983c8391a735c091cf75d08f6f24a66bf1c3cbc81b27a7afcb3

SHA512
68cc8afdc4315737dbf8b9e6c113cb2a9d7ea83c405bac93618d4c36b918bfc7980653b68169d761e8aec732ad30a9d54b678af8d1cffea424f225d0a7f86cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8d4ddc3e01d04fd36845a2e010663468

SHA1
5acadb2811bf33467d7852e925e88f76cea6ead8

SHA256
0b02acad79c01fa02396eb599a2a448cd3cc4ca52573f85e147d5d0c49a3df5c

SHA512
14964ea9b2d045c8a1295cd3612893f09bb51bcb0a2bb7f13ee81faf9bda511232ea105260bf2d17347b645ff716a7337ce973bb64f6deea89506582364d5260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
56fb83abfdd732ee390120c38cc8fed3

SHA1
6110ea0e99a7a514cae01ed9f1b7555de3219705

SHA256
20e321edc18c1d4833c68260159bed0428bdfbf903d7bd6a81bf786ba8178a7a

SHA512
a13fd650dca3e3eb22d546e6c4b2cc9ce5f2e6faf7c08fe365ea81f4fbc32050f1a026e852bd67a0de1786c95d463568acb1e0e344ba8c2d02da934ef0b76d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b050a02515623948122b149901d29cf7

SHA1
2471b98ceaf93162a5e0d8a572cd99f9cb3a19a6

SHA256
76e0d0dfa57c361cbb602265c80896923534dc29c20918bfdee4c97822d916d7

SHA512
42efb6c6002318570ee438ba9be6145d04dbfec38afebf136d3fc94b267f3f4866644fd863ef168fadc910e12fb4e8b50c55f598cf2d23932e7ff206f87eddac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e5a82099a6cc7f4eb5160850500b131

SHA1
863653482c41e410eee0484b653c98fc949602fa

SHA256
d9e0c0f5dbc0fe7a07607ae236cdc9c2b2df743151c1842eff93d7ebbf7277d5

SHA512
28fcf73e5598229e6b4541568f8e43dfd2af0691239e356288832eb6361deabebcfb34a0626307d8b269d6b10115187b37393743d575ee5b8c87738d83880117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
c2706d76a0729dc666a8a5302e083809

SHA1
998bb3bba5d9a73133cd794f9f4f824da2f6de13

SHA256
4782a83e5b76ce2eb06d74a91228d723f1e77830e0d2d10b4d13f0df71a8d42a

SHA512
ca88741887ff0024d31d881cb81860ecf2a77e583e6c7fc9525bb7a5bb24763511e3434d01908d286508a0d25c92d137accc7ff2eef591095cd081847832bf61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb80.TMP

Filesize
204B

MD5
fd9e870358d9616120fe445a9fe30687

SHA1
e7569c5f7b7c30cf0d14d46f0e8dba2dcb88291e

SHA256
8621f8f4ee884f2fbafcab8f589253fa1598fca9d5b9be761adc4fc35ae5afc6

SHA512
1551f109ae3be2d7af7000837daf3dbb1c436c6c7a3a7cefe3e229816d610dbd2719ba3e21ff6328c3f786775b29e032d86768edf4acf724b45b749ac5aa42f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c497c3c41d81d4cb4a6076f28b69de63

SHA1
d09fa2289c8c5d486a8c4e65cf97a5fc69f7119a

SHA256
440c0df657bb0e469ca4938b4b81ed786c9784af6ab50733bee0a087b20561e3

SHA512
1233419af6c2c78b24c42ba4e27c40707de3a3bfb6802129ac9bb83c44039a940a03d04ee60aeb7f1680e4f37d5be17380d9167ce500b0658e201d4b3b3919d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
43d677332e1923bb0bf5e01c3b51711a

SHA1
5d365b0a26a9f6bc936907492ab9e9d4a991a361

SHA256
2b514c699b3d18383004e580b6a589144e72cdec18688d5506c16c6a7e4de964

SHA512
b5d595699c20568e31ab333050435327ad189bc773515fb4874d220be9ede07e74fce57e25417be1d3874533a08ad228b848817ad0a8063936ddb1b0dbd56ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
73b690c92ded350642fe6a7001e0475e

SHA1
aad528bcba995bb6fd27626ae8da7e6698e398f0

SHA256
3cd3011e98c1ddb877b1f9735ea1539a457f09124c0f74cb75d72fd8530179e4

SHA512
6194de51ee73b860fdfd14f36821b20df0502d4fb580941b92691999e08fb2c49a5b3275e796ed35c4696f6b8ebe888ea30360ffc05c86727078290a19c1d0ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
079c9cb1a480f4045d11a4390668c74d

SHA1
3c21c3ad209b991cc41f6de50da4b228ad156168

SHA256
0da89dd838d9c59eabb65ebb2f3b270a31f643248507fc5afcb3fcd078c6db12

SHA512
b1f921570d818cf31d3ca5cc3b4a1040ba32a68334dbd633eba310fe58522e567541f449c640a8b1ab7bcdc29db8b59d5a10169ae2fff214f4482db667cafb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9529d8a993b4d32a416e90c07af92951

SHA1
63d5d6bff53a1eb6a60b89df08aa02e3b95efb2e

SHA256
7bde8b8b20b27c9d23ed6aa2aad4fbdf2dbf4cda880b70cf149361fcbda0ab9c

SHA512
4df1883d0f6f309e1d96b01196ecac26876c4c4ee1b966d91530dee04874b761865d004885bb222d0ee903afe297c5e32905d36fafbb2bded20402677c7c47c1

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 274184.crdownload

Filesize
111KB

MD5
e8ed8aaf35e6059ba28504c19ff50bab

SHA1
01412235baf64c5b928252639369eea4e2ba5192

SHA256
2d2a22db20a44474afbd7b0e6488690bad584dcae9789a5db776cc1a00b98728

SHA512
d007c96b2fad26763d27be8447ca65e0ab890deb6388b90cf83c0b3431e09b225f7424098927b54f15fe34eae953b61b45371b0df4b2d89c60be9c006ffe9034

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 332308.crdownload

Filesize
31KB

MD5
c261c6e3332d0d515c910bbf3b93aab3

SHA1
ff730b6b2726240df4b2f0db96c424c464c65c17

SHA256
4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9

SHA512
a93bd7b1d809493917e0999d4030cb53ab7789c65f6b87e1bbac27bd8b3ad2aeb92dec0a69369c04541f5572a78f04d8dfba900624cf5bd82d7558f24d0a8e26

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 383655.crdownload

Filesize
28KB

MD5
8e9d7feb3b955e6def8365fd83007080

SHA1
df7522e270506b1a2c874700a9beeb9d3d233e23

SHA256
94d2b1da2c4ce7db94ee9603bc2f81386032687e7c664aff6460ba0f5dac0022

SHA512
4157a5628dc7f47489be2c30dbf2b14458a813eb66e942bba881615c101df25001c09afb9a54f88831fa4c1858f42d897f8f55fbf6b4c1a82d2509bd52ba1536

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 530259.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 562892.crdownload

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 774368.crdownload

Filesize
111KB

MD5
9d0d2fcb45b1ff9555711b47e0cd65e5

SHA1
958f29a99cbb135c92c5d1cdffb9462be35ee9fd

SHA256
dc476ae39effdd80399b6e36f1fde92c216a5bbdb6b8b2a7ecbe753e91e4c993

SHA512
8fd4ce4674cd52a3c925149945a7a50a139302be17f6ee3f30271ebe1aa6d92bcb15a017dca989cd837a5d23cd56eaacc6344dc7730234a4629186976c857ca9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 830233.crdownload

Filesize
50KB

MD5
47abd68080eee0ea1b95ae31968a3069

SHA1
ffbdf4b2224b92bd78779a7c5ac366ccb007c14d

SHA256
b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec

SHA512
c9dfabffe582b29e810db8866f8997af1bd3339fa30e79575377bde970fcad3e3b6e9036b3a88d0c5f4fa3545eea8904d9faabf00142d5775ea5508adcd4dc0a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 86344.crdownload

Filesize
760KB

MD5
515198a8dfa7825f746d5921a4bc4db9

SHA1
e1da0b7f046886c1c4ff6993f7f98ee9a1bc90ae

SHA256
0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d

SHA512
9e47037fe40b79ebf056a9c6279e318d85da9cd7e633230129d77a1b8637ecbafc60be38dd21ca9077ebfcb9260d87ff7fcc85b8699b3135148fe956972de3e8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 918014.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 944025.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Windows\CF7B.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/372-2992-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/844-3003-0x00000000023D0000-0x00000000023E0000-memory.dmp

Filesize
64KB

Download
memory/1432-3198-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1432-785-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1588-2829-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/1588-2830-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/1588-2828-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/2268-2811-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2268-2884-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/2268-2816-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/2268-2815-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/2268-2813-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/2312-1279-0x00007FFE30F60000-0x00007FFE31901000-memory.dmp

Filesize
9.6MB

Download
memory/2312-2928-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/2312-1292-0x00007FFE30F60000-0x00007FFE31901000-memory.dmp

Filesize
9.6MB

Download
memory/2312-1757-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/2312-1285-0x000000001C010000-0x000000001C072000-memory.dmp

Filesize
392KB

Download
memory/2312-1283-0x000000001BEA0000-0x000000001BF46000-memory.dmp

Filesize
664KB

Download
memory/2312-1756-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/2312-1753-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/2312-1280-0x000000001B9D0000-0x000000001BE9E000-memory.dmp

Filesize
4.8MB

Download
memory/2312-1281-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download
memory/2312-1284-0x00007FFE30F60000-0x00007FFE31901000-memory.dmp

Filesize
9.6MB

Download
memory/2552-3024-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2552-2901-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2900-3145-0x00000000025A0000-0x00000000025B0000-memory.dmp

Filesize
64KB

Download
memory/2992-2902-0x0000000002290000-0x00000000022A0000-memory.dmp

Filesize
64KB

Download
memory/3048-3127-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/3732-3039-0x0000000000A80000-0x0000000000A90000-memory.dmp

Filesize
64KB

Download
memory/3784-1746-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/3784-1372-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3784-2885-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3784-1242-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/3960-3126-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/3960-3121-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/3960-3122-0x00007FFE30CB0000-0x00007FFE31771000-memory.dmp

Filesize
10.8MB

Download
memory/4448-2948-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/4624-3047-0x00000000023C0000-0x00000000023D0000-memory.dmp

Filesize
64KB

Download
memory/4888-3164-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download
memory/4956-3069-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/5052-2826-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/5052-1296-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/5052-2827-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/5052-1293-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/5052-3197-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/5052-1294-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/5224-826-0x0000000002710000-0x0000000002778000-memory.dmp

Filesize
416KB

Download
memory/5224-829-0x0000000002710000-0x0000000002778000-memory.dmp

Filesize
416KB

Download
memory/5224-818-0x0000000002710000-0x0000000002778000-memory.dmp

Filesize
416KB

Download
memory/5256-3177-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/5260-1042-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/5260-1282-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/5260-1730-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5260-1188-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5312-1382-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/5348-3110-0x0000000002330000-0x0000000002340000-memory.dmp

Filesize
64KB

Download
memory/5436-2916-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5436-1750-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/5436-1266-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/5436-1732-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5452-2929-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/5500-3200-0x00007FFE28C90000-0x00007FFE29631000-memory.dmp

Filesize
9.6MB

Download
memory/5500-3201-0x00007FFE28C90000-0x00007FFE29631000-memory.dmp

Filesize
9.6MB

Download
memory/5500-3214-0x00007FFE28C90000-0x00007FFE29631000-memory.dmp

Filesize
9.6MB

Download
memory/5784-1300-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/5784-1302-0x0000000070EE0000-0x0000000071491000-memory.dmp

Filesize
5.7MB

Download
memory/5784-1301-0x0000000001170000-0x0000000001180000-memory.dmp

Filesize
64KB

Download
memory/5784-1295-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5792-2940-0x00000000024F0000-0x0000000002500000-memory.dmp

Filesize
64KB

Download
memory/5924-2917-0x00000000009E0000-0x00000000009F0000-memory.dmp

Filesize
64KB

Download
memory/6032-3028-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/6112-2808-0x00007FFE30EB0000-0x00007FFE31851000-memory.dmp

Filesize
9.6MB

Download
memory/6112-2810-0x0000000001900000-0x0000000001910000-memory.dmp

Filesize
64KB

Download
memory/6112-2812-0x00007FFE30EB0000-0x00007FFE31851000-memory.dmp

Filesize
9.6MB

Download
memory/6132-1267-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/6132-2806-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download