xworm | hxxps://necrocracked[.]sell[.]app/

Analysis

max time kernel
261s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://necrocracked.sell.app/

Score

10^/10

xworm persistence rat trojan upx

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%Public%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/UWpQULMP

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1952-1119-0x0000000000D90000-0x0000000000DA8000-memory.dmp	family_xworm
behavioral1/files/0x000700000001da3d-1200.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Executes dropped EXE 1 IoCs

pid	Process
4004	svchost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2960-991-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5332-1012-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2960-1013-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5332-1034-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4308-1035-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4308-1088-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Public\\svchost.exe"	loader-upd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
748	pastebin.com
750	pastebin.com

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2960-1013-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5332-1034-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4308-1035-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4308-1088-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6700	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{3FE44ED4-BE6B-4B99-A485-7F84287364E1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1952	loader-upd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
4472	msedge.exe
4472	msedge.exe
764	identity_helper.exe
764	identity_helper.exe
2512	msedge.exe
2512	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6308	msedge.exe
6264	msedge.exe
6264	msedge.exe
2960	defcon.exe
2960	defcon.exe
2960	defcon.exe
2960	defcon.exe
2960	defcon.exe
2960	defcon.exe
5332	defcon.exe
5332	defcon.exe
5332	defcon.exe
5332	defcon.exe
5332	defcon.exe
5332	defcon.exe
4308	defcon.exe
4308	defcon.exe
6812	mspaint.exe
6812	mspaint.exe
2284	mspaint.exe
2284	mspaint.exe
7124	powershell.exe
7124	powershell.exe
7124	powershell.exe
6628	powershell.exe
6628	powershell.exe
6628	powershell.exe
3076	taskmgr.exe
3076	taskmgr.exe
4084	powershell.exe
4084	powershell.exe
4084	powershell.exe
3076	taskmgr.exe
3076	taskmgr.exe
5652	powershell.exe
5652	powershell.exe
5652	powershell.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
1952	loader-upd.exe
1952	loader-upd.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4308	defcon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	defcon.exe
Token: SeAssignPrimaryTokenPrivilege	2960	defcon.exe
Token: SeIncreaseQuotaPrivilege	2960	defcon.exe
Token: 0	2960	defcon.exe
Token: SeDebugPrivilege	5332	defcon.exe
Token: SeAssignPrimaryTokenPrivilege	5332	defcon.exe
Token: SeIncreaseQuotaPrivilege	5332	defcon.exe
Token: SeDebugPrivilege	1952	loader-upd.exe
Token: SeDebugPrivilege	7124	powershell.exe
Token: SeDebugPrivilege	6628	powershell.exe
Token: SeDebugPrivilege	3076	taskmgr.exe
Token: SeSystemProfilePrivilege	3076	taskmgr.exe
Token: SeCreateGlobalPrivilege	3076	taskmgr.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	1952	loader-upd.exe
Token: SeDebugPrivilege	4004	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
2284	mspaint.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
4308	defcon.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe
3076	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2960	defcon.exe
5332	defcon.exe
6016	OpenWith.exe
6812	mspaint.exe
5856	OpenWith.exe
2284	mspaint.exe
2284	mspaint.exe
2284	mspaint.exe
2284	mspaint.exe
1952	loader-upd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4044	4472	msedge.exe	86
PID 4472 wrote to memory of 4044	4472	msedge.exe	86
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 4692	4472	msedge.exe	87
PID 4472 wrote to memory of 2540	4472	msedge.exe	88
PID 4472 wrote to memory of 2540	4472	msedge.exe	88
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89
PID 4472 wrote to memory of 4660	4472	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://necrocracked.sell.app/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd95a46f8,0x7ffdd95a4708,0x7ffdd95a4718
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1448 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8604 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:6584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:6408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9144 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8628 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:6432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:6464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8924 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8512 /prefetch:1
  2⤵
  PID:7144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8432 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=9212 /prefetch:8
  2⤵
  PID:6316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,16174551395215545343,12256102203504553962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3980

C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\defcon.exe
"C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\defcon.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2960
- C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\defcon.exe
  C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\defcon.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5332
- - C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\defcon.exe
    "C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\defcon.exe" /TI
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\Defender_Settings.vbs"
1⤵
- Modifies registry class
PID:6612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6016

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\ezdebug.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5856

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1516

C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\loader-upd.exe
"C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\loader-upd.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\loader-upd.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader-upd.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\svchost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5652
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:6700

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3076

C:\Users\Public\svchost.exe
"C:\Users\Public\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
198KB

MD5
319e0c36436ee0bf24476acbcc83565c

SHA1
fb2658d5791fe5b37424119557ab8cee30acdc54

SHA256
f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1

SHA512
ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
53KB

MD5
5b54e3f052ddd552bca734b6fd20fa2b

SHA1
887fdeb8c5bed23fdedf3f3f23017b1a7bf192df

SHA256
6c519d1fe15e1772bea69add830c0020b0ea2208a7df4fc81b2ed1fe2748ee90

SHA512
7e649900260fcbddbf9636794d5f920f306fa9149331e0f96b2b63977ee1b9957a8920e957b3cc3a25ea575f42a55e0594788304c057705e34e5dc231e31cc5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
21KB

MD5
891a54bb8c94c43b529b59ecac9db4b5

SHA1
ffd25106f1ef2e17873348f42a9a2ce25a818542

SHA256
cc18d561acde5d1cb1403bc187cc5243bf3e197ba8cda948cf008104fc63ccd5

SHA512
18b345de45d962a37fbb319bee11f7317d7fb913be5a489ae71358b07ef66133cefaa1b83db7f6037aa7f40f97ec27b1cec0a042b1b02ee0e8eb0524464e4db3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
64KB

MD5
a92436fe7a2ed3e19f3fc3f10f583b0a

SHA1
d204c134f81cc850d874c20edb971b0b0a6698ab

SHA256
2906a201224e53e041c1822eac1fa67de9de5c2062c200aea0f4a80d586790db

SHA512
b9e338e9cb024973dd0309418d45edde4181ccbc3338271635fa756f7a0f4601841c543c1a61d2fb1969be2e023b7fe6593a809ea0ef259c629cfc4e70cb576c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
90KB

MD5
a17e2d4985214862793e7f25255c1aa6

SHA1
1458092cd055c0167583aff281fd4cf238a97f71

SHA256
c91a7cdadf368c8d5c635dafa31add367cc5fbc76cbd8878b22cab91c9fa964b

SHA512
538937e7df5c487a6d5f5796260d39a7dec029939286b8c4e8c596d687d57390edf0a8b7ab8361c09c04dd2f1b910af71525275b47e745942257a573c92551a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
337KB

MD5
499fcada6ddb2c38718c2c16a190d639

SHA1
9ef5d7d28925b9e0213f67b8105870e0afade711

SHA256
8af7bd5b545567adffb3dfceb5bedb353a522d7bf1b3a2b8af7b6064156babc0

SHA512
87a11b8a8cf75924370985a9975f88e427eff4550ed8d88fcb9fc69d294cb7320f216cc72748742705779be516cac02e57f5c4423d8e486612f657636dcac4ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
65KB

MD5
d37a0b50e8cbbc3de35d3d1e9e1185cf

SHA1
c898ddfa3f2c551980ab4bef4a463c3fd11021b3

SHA256
deb12434ba06baf14aed67ee8aa28f48ae856f3792797eeeab1ee218754caf04

SHA512
d52983a3cd1343454bb9bfecdcdb76791a93b15fe83a46a62ca668041fff818f94815b6c596c2794972e11df3f4139a86e480578cd5e332bf9325e6e5e1572ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
30KB

MD5
6fb26b39d8dcf2f09ef8aebb8a5ffe23

SHA1
578cac24c947a6d24bc05a6aa305756dd70e9ac3

SHA256
774379647c0a6db04a0c2662be757a730c20f13b4c03fe0b12d43c0f09e7a059

SHA512
c40f4771c10add1b20efb81ee3b61fc5ede4701587f29a1c2cdde8b6faabd1c76d769bf8b99aa19082012f95d99ba448a472463fb9056acd2e43542e14e605cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\058f855265417643_0

Filesize
242B

MD5
125d341a838ba46d015baae31753b907

SHA1
94714da0a9821f69f8b07c5badc9ad42a78f4232

SHA256
c4d3f54909d5dcc42931676977db99cfe55f816f9086ee7f5e9895dc2639df1c

SHA512
6649581695f1a8acc94930de26a94040a3289a2dcc5e974f33c1f02d64a56af5b0de5863067fd33c4a7da54e220e7511891a3213840b19e57439bf1d893efb14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d1d9b7f76441546_0

Filesize
250B

MD5
ac5e16b78705a67b7dd7bdb2eb8de4aa

SHA1
c4eedf6c2b5887131ebd01ce335a56bd6e343f4d

SHA256
1784569a42dd796eee0657a64e5eefeee33271c205a6da04054ba47fd84a9f9f

SHA512
e1f9fedefd77575bc0e6e54a3d4f4afbb4c8fbc7486182a0565ff250b4db397cfde1eb44862ce9e58591c64af01e39d818f0a79670a68ebb46748643974c3ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\336a68eaaf209f48_0

Filesize
309B

MD5
3ad89da48318d6ed13f9eaad976b5f38

SHA1
b756d81d88be244c385e57102786f174426a484e

SHA256
370a32696607abf12a7642e48d1bb0012731901e07f1dbb286e34b64788b3d8e

SHA512
4295268cb93d18a8d615d806c4b0e5c4c01fc8c0c81f8b1faa48debe33b160bee3837a912b57d94b2466db9ff56e60afbabbdff773dde01f9a596c9aa3fda397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c307b02b4dcc58c_0

Filesize
228B

MD5
d6babba25fc08e5919f1ea8428a9cf45

SHA1
daaeef593e823ef2db9d828b62c7c016619c6253

SHA256
be366b51182757e959a84eb1e1e67be873285b5b9eb9549e3cc728d568edb0bf

SHA512
2fd7a8b246aab2e1f1615d4eecd0565541280ce4b07617c2dbf952a3568f49a9cd2d1887396ddb0a32f4ba94aaa339bbb5bf6f28c31ae70111745fc7036609d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f7c3f463e5716c0_0

Filesize
407KB

MD5
be4dffcc2d1758eda4ffb06ac8bd2c3c

SHA1
a51fa6143b467ad937910aed1b27b946e00fa75f

SHA256
ae093ab52e38086f7cd009e4fc65e7074868273661ca44688bc86bd302961384

SHA512
b4b7a3c5ecf0561d098a7ad5d7102d5511967e3deba0b81742374e8dc0fea7d6088ffe940e2832e3fb62ebbb1294b4c32569e6192a1499767799d4e291161941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daecd929587c6d42_0

Filesize
253B

MD5
55bfb06e2140273a0249ec09ca0398ef

SHA1
dde09d6f8ef4ca92ddfac4f0c4530dd831292a19

SHA256
9b2aaacc3c7babcfe62fd85e8188a81d54100a6af92bd93f40effdff4bbe34cf

SHA512
bd55d4d14888f2a7e05ca3c308f3477041f1d81be8e7a381e4bf2c08c779b29e72f3678c3cacb46d6d55fda2af9acf1d3e02479ad34af7c2aa186267ab18c556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
12c455af9ff8ed36907bcd97a982b275

SHA1
96d3725466fee853f233f24bbdcc0896687d09b1

SHA256
ac36b313263d3dcf02bac1e51d945e92814333073860e8e899d4fead44a2dc15

SHA512
7d5e8bb17494961490f187758bd0dd052b4b9f12e84d72f8172307394db937c6ab2904ea646692c087fdb3e9516d7f2064faf421de93fc7b6a28b7fca5e9fd4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
0b69a6a7abcc647fba5387ef549b1c23

SHA1
e5269ffa65513db002e289a5658578924d056808

SHA256
6b3e9134754851fdbd28dc7e1a80d8acadd15a18e592ac88a1d77f11a7609be9

SHA512
8f8c99cb3bd0720428dfc899f706247baaa279f9f321f26b7a67edafc9f8bca913d0242865b79898ba2d0d37a512b7965ead70390e70ef0c934e267c33516159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
847af1a38ccbcbe498e4e0953ddd757a

SHA1
8c9c2829dfa00992ce040e908b2be780f39570e0

SHA256
7f62f6e190314be790b5c769e771b83eafb6b01a3259b85a1cc69c24e1745bd0

SHA512
93e18cc94f526ab49beb151949fac35694d59e3da094999bc67015ba63f86e8bb1e7521f0f862cfbacf8d8e67b9c797aeee968348e08a2a1cf37e24c3511cb63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dbaf76af58e88f3e40576515a5e69e21

SHA1
85bc9e3f1772eae1b8f65d1e6750bd1781cf8625

SHA256
47c9d7d28f16ffac8376247ca05580f9d1080948511c8e9d6dc851612fa1ae18

SHA512
a38429121b105953fb7f3df96cf2dbd09fefb9f4df16bde66d7dde8f1ac85a3ab548130f1c55cc8efa9cdedfff6486e4a34ae4c81c98796527ec2043089d1d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
cace1572c35b44e21aa90448ba865427

SHA1
57c44f13637259361b97155c186e18583a2879f7

SHA256
fe23a0cb22d85b220e4a1b2071fb4f6501a45fcee98ef8612e7620e0bfde3960

SHA512
390631020f3e83bbfa50d4e4fc94484da3dab42ec8d56064c213b1348f88a26f6e573b42ac45283521199a7126d8496ad05ac17da24dd015c180ba001582b838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
fb30aadf518829462cb8fa3212845706

SHA1
b5fb428e1cc1b0f6d8e506f6f1c0461f2feda3bd

SHA256
bb93bed65ba58b81aa5b6fea9d2f506940b7616ac4d6e71ae30795d48b584a90

SHA512
6726f0851038287aee239353e4610c4668e12b30edd7aab82a807e4f90f9df69d598ac592a6596b388e6ede7768619b18fb7eb1b52f0e28765f838e4a33e4195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98f4c31fce117e4583567a67b4fee353

SHA1
227f0c92f3c0974bd1fc6d906c780745c4487c0a

SHA256
b75028ed48e5a3d777c68ed80b65a86138a67e2cc34d1eb2f5ee21f872936bf6

SHA512
0ead9b3d3517599d0350f853092a40103fbdd3ffb9094f81b0c5cf19c02bd199f4d772af03f82bece49078ddc9da578d762d3a6df5b2059f54c28f8bdf43d2f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
66fff35ded4879cfcb526b2b6b7a50c0

SHA1
5c6119801e4ae6b4e5319d2d896adf05e5d46436

SHA256
ba7ecccad88847de1fd0ba2824c920e86f958b1b1a7e2589b17c6255eacf4f17

SHA512
387cf6ebf9025c702b6ac446c0069aa68465806739e4638968f729216724e0a46bf5f0e71f25bf40a5802a67d20d8b867c6b10540eb5661d45d5f19ccf5fb558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
971bc8380f23fdc20eb4867a2f8a9d53

SHA1
2a6bd010b7cfa49f6469cc607e0a8449e8a83635

SHA256
5cc6c91b2d507ea26cbb7b397b2396b5eecd9a15872873116232aacf450fd72a

SHA512
4b04858337b1081d0fd8a91fa719a1ab98a01e88682a8e99542076ad48119d6b2f87e021c7d46b5ca99052ea17e742ef4e2767afb09513b4b234bcd7bba269eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d2e71127b3e3dec6ea3b4ea78c727bc

SHA1
a5fd5bb49ea3de7a049e886c485834d85d9c5f02

SHA256
a1fef12a88534bad1e4c98f541727633ffef1beb3053ce8f2ccbc7b070e130fc

SHA512
7b4e6645710db9f6d70cffb43df6741b04d42a0b3353a32966a355cb952717e5dcbbe2a5cd931b737143bdfea9e2011b62b5aa53b3a1c84f4ca4166aed8a46de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9ec7a7e24f837c080f75601d78c42173

SHA1
d51f2f8c58d50ee7f8ef5ad24f31610014d6e0ac

SHA256
17b25f2a6a4580b09f894d12904d8d8622ba20cfcf30c6b27ced49f19c0bc6fa

SHA512
57010d56211c8524de8e5db56f8783516d7a67e7afa985a1d0dfabbb1c9651642a4527c1f66481477b3019e728d6f3d9c2193d9136ded48a295098ab5c121667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
efed2920a484fc5fbd3daeb171cfc2ee

SHA1
f5241e2b2f604f44d717ad24e7a7fc9333d666e6

SHA256
76e035ea44ee2f07aeaaecec217c63a284cdd203f9b1ead6cb2bd18bb515d68c

SHA512
7accf502be5b2a0e5ba572022fde7d4771670592f748f4445a4b21f678a0d97ce81b63573135eee7531631b0d608b10123c356b68af35c72834c9e653641de9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
83eaea219e46380128824bbbdac2907b

SHA1
6c6990f20cffc2d901008f296d73700098941314

SHA256
56eefcdac6b372fd719f32c18f598498da5b2e917c05a13b8bd408b08715f948

SHA512
bf7bf43166c095a5c7edaef82a8f322331044fb19b4e0aa7b0828cfc1afed4572b9afb794798ad98efaa715f522e028378812e21a5b0ece4d8b2ffe9fc83e09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a5f9218dab946625d15386209666136c

SHA1
8329a5b188dbbb833a4afcf13d726ebf869a483e

SHA256
1655b4e6fdb1b3f6430b6ad88b57e317109d6483d5a0d790bda7439d3390426a

SHA512
345b0a3ce0788cb42f319e67de05a4540ddcd001022f89d3e55af182d85b71c509280bf70803ac9d7c8d7ff1c50e54ff8a00bf661047aa0841be3e822cf822fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5a9620801a0d65e5c1f363e21a1fe5b4

SHA1
d94ce8bb672a48832b21b8367d7341a2f819143e

SHA256
868724388df1961dc46ab26f58d778941850668748db5935beb754de6d99912d

SHA512
665c5f5f71bf30b4e4cb9415c9d28b62b7505fcb0f1092b94ac68444a14d34d9a3ca0dd35d892200840ee75b9ff7c54de986bb7bdb56b5283fbb2196a990edc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f00921bc8d0ad33b79fcb7f6cf2e6de5

SHA1
5df6b1d2165b978b6d56a18f28ababa798473e10

SHA256
1fc3388b3469ee400b4b57bcf04a7cb0dec9d230f0f45ce692cf8b12dda6a246

SHA512
0a1b0175a5a14e671f5813ac068f5f4de37bd1d628e280286645c827c480e15bdb525ad6bddf2c15a061c26525f141de753bc2bd0958fd49e13159b3962146bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
78c4e13216e1cb35d22f6f1fbe3e8687

SHA1
d23800ae3c8d48ef3ac3d95cba8b74f37aca9810

SHA256
ddc1ccd184c8dec9ebdade39ee2bcc420d889d869632671c8fab9712850cd7cd

SHA512
025d55330d552958eac56c466e186bf8a3a938b2d31bbbefdb77f73048fc11b16dbd5cc3de59cd50b1ea5342594a12b7c80f4bb8caaea28e0f7263b1262af975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6f3581b3b7bb58cd7faa541a6d6d3a4d

SHA1
779d7e22f5ea83ffa7ebb2b591fe016e79084340

SHA256
113e9b72efd7ce810fc09d9e9584a149ce89aeacd6a1a59c6f693fdb50871a5c

SHA512
5bd1ccfa7b0c2404f7cdd90ec9f0ef60537d838288fc8450dd921b7ce345e0f40d1ea69d9e03fdd82a09c3c85c8580fa58f46475a2d97c7f2d7b5419accf9fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5f90a35efd7dd3979f14bd23aef02642

SHA1
0d65fe1a7683e5a6a0c24f4f9c6a4a1742d07bb7

SHA256
8d9d00f7f1aa96844eed038a4f1b9c7af8386bc48c2d1112743a0adc4f0c4e55

SHA512
bc9222993073ff7210e37c216a18a4298cdce4d6b424df45b34972f41f5d6e1fe0524b9c6807ced4dffdabb6f009d72e9683863f435d3124342e7a8109f9e462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583795.TMP

Filesize
203B

MD5
56d2ea06528a88da4ca23ee24367de3a

SHA1
5bc33311a802dabcbe5fd401a2a9ef9b23ffed3a

SHA256
d56849b4e100b9d3069d6f69d46bb8c6182b1090d179e45a12fe3643f342438b

SHA512
6cfae2f8729d1920c7731ef37e964224b80d843178fe132d53e78d70a18ec21fc7654442e8e3fb3bdf3dab79fc5c1d024a0cf8ff38c903a2c78a19ba4803586e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ee4221837ebdb63fd724c5097dce68c3

SHA1
ee4dcc99d0ccdb56681894192afdff91cea85e7d

SHA256
4f09f762d2cb8c417b2e80333b4081177f8e1f60f4d904bc874e37333b1cdd63

SHA512
a3149100f269468161142372edd805b215b778f8a2cb21f0c41cf288e175f9918af124dc36f6e608c2533dc81577b85f9b3a84cffc6c9c714c826e678e0b2d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5f688f3-5d03-4f54-a4ac-4871ae9d87ae.tmp

Filesize
11KB

MD5
3fdc5b43dbc3b5801fbf76b760ea2864

SHA1
05cb5054af0ecfc05bad7ee06b8030f91b5e43c6

SHA256
dcc250d1bfea94b762279cc81f94002169ff1eb512430ccabab820ab5c40f7ed

SHA512
5ce7988c2aaaeea0860d8953e5b7b8333223cec3ca25885b22664afe76b16be0de55579415e24b399dc4a80b5ec9fccbd86bd386f06cc55235ffc47cb009c67e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
15dde0683cd1ca19785d7262f554ba93

SHA1
d039c577e438546d10ac64837b05da480d06bf69

SHA256
d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

SHA512
57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hoe4zrq4.20u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8.zip

Filesize
535KB

MD5
11e7644c95387c1860ce7e936c749f74

SHA1
a483dfec45aa156c31e5600b88ef043f23fbaaf1

SHA256
8641f88b89c9076ece3ee571baa4b3c93ba3ac3883e90fe5f894dc41e3b7bdc7

SHA512
d9ffbf735346887b7c4922fa6fb5a2c08d73cd8874cca3c36211b87138134ae718ecb16d593e7ca9aceb634ae7655cf61b2fd1d255be5f3b9f580aa072aef0f5

Download Submit
C:\Users\Admin\Downloads\LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8\Ro-exec\defcon.ini

Filesize
2KB

MD5
aa9ca6f0434e1873771ec15e761be2fb

SHA1
1a50a20da9a5d19b8e5f04a2e872b7cf390d8420

SHA256
d24224ee3676229d8ca9795e458106fbe1c0f5fff99ef4db5be7da42ebb71b3f

SHA512
e64e180983c25f2be7918c5b4a6578c815d6fe2a6cf5ad4513497e364f4736d4c6728c1060606127165d50708736ea4be07e76bcbd1e2464981c547cb86c6076

Download Submit
C:\Users\Public\svchost.exe

Filesize
70KB

MD5
573bd20fc8382d92a7ae9eae51e738e3

SHA1
55006093429df791f27e91a66e5ee63a81382b28

SHA256
09036ffa342f9e5bb1e31a867dcc3b60db011baba8c0d202aff1d33195cbe729

SHA512
d38736acff4128d6ce9ea17ee609ca33a37ac88f2c994cf4caf7f0eb62406a8963c33531b9f3cd020974d892c2751f3a4f67ce13ed6ba6080f97c406ccbb4aca

Download Submit
C:\Windows\Temp\4d3g0j8w.tmp

Filesize
37KB

MD5
f156a4a8ffd8c440348d52ef8498231c

SHA1
4d2f5e731a0cc9155220b560eb6560f24b623032

SHA256
7c3ca3161b9061c9b1ff70f401d9f02b2d01267bc76cbfcbc397a5aec60d4842

SHA512
48f3c273f072a8c3c73a1b835ed320a6b8962c2f8b5037a3b6c1bea5431b17d9c03e8d771cc205bbc067975c78307f2306c55dbc4c72e0a7c15c6b17b3afa170

Download Submit
C:\Windows\Temp\5d3g3j2w.tmp

Filesize
37KB

MD5
3bc9acd9c4b8384fb7ce6c08db87df6d

SHA1
936c93e3a01d5ae30d05711a97bbf3dfa5e0921f

SHA256
a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79

SHA512
f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375

Download Submit
C:\Windows\Temp\autC579.tmp

Filesize
14KB

MD5
9d5a0ef18cc4bb492930582064c5330f

SHA1
2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8

SHA256
8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3

SHA512
1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4

Download Submit
C:\Windows\Temp\autC57A.tmp

Filesize
12KB

MD5
efe44d9f6e4426a05e39f99ad407d3e7

SHA1
637c531222ee6a56780a7fdcd2b5078467b6e036

SHA256
5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366

SHA512
8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63

Download Submit
C:\Windows\Temp\autC58A.tmp

Filesize
7KB

MD5
ecffd3e81c5f2e3c62bcdc122442b5f2

SHA1
d41567acbbb0107361c6ee1715fe41b416663f40

SHA256
9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5

SHA512
7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76

Download Submit
memory/1052-1106-0x0000016D7C660000-0x0000016D7C661000-memory.dmp

Filesize
4KB

Download
memory/1052-1108-0x0000016D7C670000-0x0000016D7C671000-memory.dmp

Filesize
4KB

Download
memory/1052-1102-0x0000016D7C5D0000-0x0000016D7C5D1000-memory.dmp

Filesize
4KB

Download
memory/1052-1104-0x0000016D7C5D0000-0x0000016D7C5D1000-memory.dmp

Filesize
4KB

Download
memory/1052-1105-0x0000016D7C660000-0x0000016D7C661000-memory.dmp

Filesize
4KB

Download
memory/1052-1093-0x0000016D74260000-0x0000016D74270000-memory.dmp

Filesize
64KB

Download
memory/1052-1107-0x0000016D7C670000-0x0000016D7C671000-memory.dmp

Filesize
4KB

Download
memory/1052-1100-0x0000016D7C550000-0x0000016D7C551000-memory.dmp

Filesize
4KB

Download
memory/1052-1089-0x0000016D739C0000-0x0000016D739D0000-memory.dmp

Filesize
64KB

Download
memory/1952-1119-0x0000000000D90000-0x0000000000DA8000-memory.dmp

Filesize
96KB

Download
memory/1952-1120-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/1952-1194-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/1952-1199-0x00000000016D0000-0x00000000016E0000-memory.dmp

Filesize
64KB

Download
memory/2960-991-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2960-1013-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3076-1175-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1157-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1177-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1178-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1176-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1172-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1174-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1167-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1156-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/3076-1154-0x0000026DCF760000-0x0000026DCF761000-memory.dmp

Filesize
4KB

Download
memory/4004-1204-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/4004-1202-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/4084-1155-0x000001648D440000-0x000001648D450000-memory.dmp

Filesize
64KB

Download
memory/4084-1153-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/4084-1158-0x000001648D440000-0x000001648D450000-memory.dmp

Filesize
64KB

Download
memory/4084-1181-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/4084-1179-0x000001648D440000-0x000001648D450000-memory.dmp

Filesize
64KB

Download
memory/4308-1088-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/4308-1035-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/5332-1034-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/5332-1012-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/5652-1195-0x000002082CE70000-0x000002082CE80000-memory.dmp

Filesize
64KB

Download
memory/5652-1188-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/5652-1192-0x000002082CE70000-0x000002082CE80000-memory.dmp

Filesize
64KB

Download
memory/5652-1197-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/6628-1149-0x000001D6D4600000-0x000001D6D4610000-memory.dmp

Filesize
64KB

Download
memory/6628-1150-0x000001D6D4600000-0x000001D6D4610000-memory.dmp

Filesize
64KB

Download
memory/6628-1152-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/6628-1148-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/7124-1132-0x00000178E7300000-0x00000178E7310000-memory.dmp

Filesize
64KB

Download
memory/7124-1130-0x00000178E7480000-0x00000178E74A2000-memory.dmp

Filesize
136KB

Download
memory/7124-1131-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/7124-1136-0x00007FFDC05B0000-0x00007FFDC1071000-memory.dmp

Filesize
10.8MB

Download
memory/7124-1133-0x00000178E7300000-0x00000178E7310000-memory.dmp

Filesize
64KB

Download