hxxps://download[.]net[.]ua/thekrnla/

Analysis

max time kernel
142s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/04/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download.net.ua/thekrnla/

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5788	KRNL-NEW_PIK10OgKA7.tmp
2396	zoomplayerplugin.exe

Loads dropped DLL 3 IoCs

pid	Process
5788	KRNL-NEW_PIK10OgKA7.tmp
5788	KRNL-NEW_PIK10OgKA7.tmp
5788	KRNL-NEW_PIK10OgKA7.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 35 IoCs

pid	pid_target	Process	procid_target
5284	2396	WerFault.exe	121
3556	2396	WerFault.exe	121
5344	2396	WerFault.exe	121
5376	2396	WerFault.exe	121
4244	2396	WerFault.exe	121
4520	2396	WerFault.exe	121
4572	2396	WerFault.exe	121
2624	2396	WerFault.exe	121
1076	2396	WerFault.exe	121
2948	2396	WerFault.exe	121
2484	2396	WerFault.exe	121
3100	2396	WerFault.exe	121
3516	2396	WerFault.exe	121
5844	2396	WerFault.exe	121
4144	2396	WerFault.exe	121
5868	2396	WerFault.exe	121
5964	2396	WerFault.exe	121
6024	2396	WerFault.exe	121
6048	2396	WerFault.exe	121
6076	2396	WerFault.exe	121
6104	2396	WerFault.exe	121
5160	2396	WerFault.exe	121
4444	2396	WerFault.exe	121
5280	2396	WerFault.exe	121
5320	2396	WerFault.exe	121
5328	2396	WerFault.exe	121
1632	2396	WerFault.exe	121
4140	2396	WerFault.exe	121
5364	2396	WerFault.exe	121
1832	2396	WerFault.exe	121
2584	2396	WerFault.exe	121
5560	2396	WerFault.exe	121
2288	2396	WerFault.exe	121
4404	2396	WerFault.exe	121
3260	2396	WerFault.exe	121

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133588866015095091"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	zoomplayerplugin.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{22929B82-194C-439B-A8DD-B285D1B90E87} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{72265DCF-C346-4EED-BBBA-985759CE32EA	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f7d7fbc15d9ada01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ffaff8c75d9ada01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{72265DCF-C346-4EED-BBBA-985759CE32EA = bc6d1edb5d9ada01	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 5abfffca5d9ada01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a3e9d0d65d9ada01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\KRNL-NEW_PIK10OgKA7.zip.odwngcl.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
5788	KRNL-NEW_PIK10OgKA7.tmp
5788	KRNL-NEW_PIK10OgKA7.tmp
5936	chrome.exe
5936	chrome.exe
2396	zoomplayerplugin.exe
2396	zoomplayerplugin.exe
2396	zoomplayerplugin.exe
2396	zoomplayerplugin.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3084	MicrosoftEdgeCP.exe
3084	MicrosoftEdgeCP.exe
3084	MicrosoftEdgeCP.exe
3084	MicrosoftEdgeCP.exe
3084	MicrosoftEdgeCP.exe
3084	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe
Token: SeShutdownPrivilege	2960	chrome.exe
Token: SeCreatePagefilePrivilege	2960	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
5788	KRNL-NEW_PIK10OgKA7.tmp

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2428	MicrosoftEdge.exe
3084	MicrosoftEdgeCP.exe
4924	MicrosoftEdgeCP.exe
3084	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4340	2960	chrome.exe	73
PID 2960 wrote to memory of 4340	2960	chrome.exe	73
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 3020	2960	chrome.exe	75
PID 2960 wrote to memory of 4424	2960	chrome.exe	76
PID 2960 wrote to memory of 4424	2960	chrome.exe	76
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77
PID 2960 wrote to memory of 2208	2960	chrome.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download.net.ua/thekrnla/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcc8a79758,0x7ffcc8a79768,0x7ffcc8a79778
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:2
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3668 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4756 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3628 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4924 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4452 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4696 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5476 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5416 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6320 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5696 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5876 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5900 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5428 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5648 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2988 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5676 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5184 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5912 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6440 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=2956 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5608 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5492 --field-trial-handle=1728,i,3376849256636371807,17892039842870397449,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5936

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
PID:3684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3084

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5656

C:\Users\Admin\AppData\Local\Temp\Temp1_KRNL-NEW_PIK10OgKA7.zip\KRNL-NEW_PIK10OgKA7.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_KRNL-NEW_PIK10OgKA7.zip\KRNL-NEW_PIK10OgKA7.exe"
1⤵
PID:5704
- C:\Users\Admin\AppData\Local\Temp\is-M0EGH.tmp\KRNL-NEW_PIK10OgKA7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M0EGH.tmp\KRNL-NEW_PIK10OgKA7.tmp" /SL5="$3042C,5945680,56832,C:\Users\Admin\AppData\Local\Temp\Temp1_KRNL-NEW_PIK10OgKA7.zip\KRNL-NEW_PIK10OgKA7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:5788
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Zoom_Player_Plugin_4292"
    3⤵
    PID:6132
- - C:\Users\Admin\AppData\Local\Zoom Player Plugin\zoomplayerplugin.exe
    "C:\Users\Admin\AppData\Local\Zoom Player Plugin\zoomplayerplugin.exe" a95c6a5479b081d3b1d7a0496896f5dd
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 836
      4⤵
      Program crash
      PID:5284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 812
      4⤵
      Program crash
      PID:3556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 880
      4⤵
      Program crash
      PID:5344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 984
      4⤵
      Program crash
      PID:5376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1020
      4⤵
      Program crash
      PID:4244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1060
      4⤵
      Program crash
      PID:4520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 972
      4⤵
      Program crash
      PID:4572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1204
      4⤵
      Program crash
      PID:2624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1244
      4⤵
      Program crash
      PID:1076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1172
      4⤵
      Program crash
      PID:2948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1272
      4⤵
      Program crash
      PID:2484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1588
      4⤵
      Program crash
      PID:3100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1632
      4⤵
      Program crash
      PID:3516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1280
      4⤵
      Program crash
      PID:5844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1744
      4⤵
      Program crash
      PID:4144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1572
      4⤵
      Program crash
      PID:5868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1696
      4⤵
      Program crash
      PID:5964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1824
      4⤵
      Program crash
      PID:6024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1600
      4⤵
      Program crash
      PID:6048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1692
      4⤵
      Program crash
      PID:6076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1880
      4⤵
      Program crash
      PID:6104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1896
      4⤵
      Program crash
      PID:5160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1920
      4⤵
      Program crash
      PID:4444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1956
      4⤵
      Program crash
      PID:5280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1992
      4⤵
      Program crash
      PID:5320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1968
      4⤵
      Program crash
      PID:5328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1804
      4⤵
      Program crash
      PID:1632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1920
      4⤵
      Program crash
      PID:4140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1976
      4⤵
      Program crash
      PID:5364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1980
      4⤵
      Program crash
      PID:1832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 2036
      4⤵
      Program crash
      PID:2584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1988
      4⤵
      Program crash
      PID:5560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 2008
      4⤵
      Program crash
      PID:2288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1868
      4⤵
      Program crash
      PID:4404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\H99f0T9t\ursMNihMSIi.exe"
      4⤵
      PID:68
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\H99f0T9t\ursMNihMSIi.exe"
        5⤵
        
        PID:2144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\UG4M0CC8\2doUtrR8O8kV5cZa.exe"
      4⤵
      PID:1076
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\UG4M0CC8\2doUtrR8O8kV5cZa.exe"
        5⤵
        
        PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\XSgbWPJo\MmLgcZ1dCCrRxp2MaM8.exe"
      4⤵
      PID:3128
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\XSgbWPJo\MmLgcZ1dCCrRxp2MaM8.exe"
        5⤵
        
        PID:2400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1908
      4⤵
      Program crash
      PID:3260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\cX1kBsWR\BdbByrol0p2OK.exe"
      4⤵
      PID:5796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\cX1kBsWR\BdbByrol0p2OK.exe"
        5⤵
        
        PID:5860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\33ES0Fbe\Sd3NVDJEyQpPKA9eSBb.exe"
      4⤵
      PID:5572
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\33ES0Fbe\Sd3NVDJEyQpPKA9eSBb.exe"
        5⤵
        
        PID:6092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\00f46b0a-20d3-4c77-a009-c5a40520c125.tmp

Filesize
136KB

MD5
f5e83b2e2b48f0adc4f6330905d799a0

SHA1
f68dabe60b5d1a1c3ef8f18589cf4b1413f137b1

SHA256
716a307f75f57d0654ff31912f8523cc218ee0919d2ea6b35a225c0c8014f409

SHA512
7994b4249c40eccfd0ddddb7a4760e4409e9e7f4cf3d9aee7564905c56c99ecc960cecad526b45cc3dd18754761e5a96b14b3d6de181f42845695c824215ed4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\83fa697d-3272-4ac6-8822-c335169df85d.tmp

Filesize
6KB

MD5
2f6fe0f833f30b6d7bd864c501ba108a

SHA1
c5fd6c0d1a0c6ee620072c05d8590f2466d20fe3

SHA256
eb28335b3a27ab622e8704eaf70fa78c70f3adedb2a00e359e29c2ffd7a24ee4

SHA512
9038fedbb9392e7d9e6660c8e3fa35e79ba9a7e37e27446322886624ec01450b2f44faf041311f36e1ddeffb03a9e5d42c9a61f982edb47c9d9f10552cba6816

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
30KB

MD5
888c5fa4504182a0224b264a1fda0e73

SHA1
65f058a7dead59a8063362241865526eb0148f16

SHA256
7d757e510b1f0c4d44fd98cc0121da8ca4f44793f8583debdef300fb1dbd3715

SHA512
1c165b9cf4687ff94a73f53624f00da24c5452a32c72f8f75257a7501bd450bff1becdc959c9c7536059e93eb87f2c022e313f145a41175e0b8663274ae6cc36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0157ccc093f579d5_0

Filesize
281B

MD5
b72ff5db00f5b027cf01f97460d166fa

SHA1
2a68fb7ca0259776ffeeaaf2cfafae4b2f008e31

SHA256
61b5db27604ee78b7c7ed2781b114a85ae092e8a71f660b16d56df43e632ec51

SHA512
d989116de0e17761c5d1a3dc5a9a3330d0dfdd50a1964675f62468dd5cb072554d7e33330a855b5d90161786eeb2402f3db2d24128c50e88fe171da28c1e8eaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4ba1ddcae6e91733_0

Filesize
89KB

MD5
15778105ca449c5de60210a7e82058f0

SHA1
6c8c9108d796b16aba006e41edf03e2e2b12abac

SHA256
71f13b5e4ce1ea3c554781d022b9d16cb238fede19ad65ab594c07e326353d32

SHA512
fa2c921c2956a0f2eb81392b6a31fb115e26f684e39eab33ca730fc86b1d766a9d2cf7257e898936a6b10c60bdbf4b3f25593927a1f9552fec38a54ecebca38b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8284bb2f62cc7c29_0

Filesize
13KB

MD5
797dc25992370954cfc16eaed8ecd666

SHA1
8b34dac8914ab29bccc87b30a4464ff491727537

SHA256
0e442e003fd5ee68e894cbd025ee5f02c500fc066eb91b9fab9b0912ed6add78

SHA512
f63eaeef6614d51d7c7b5bdbfe6259464fdf38f46c3e1c061ac975c485a9fad0bfe5a1c0147ad2a841c6db10579484b8503d355472c1a0b227efe91b21d92c43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\875c3b986209d0db_0

Filesize
4KB

MD5
905149e02f97fc3c2c9c09cd27bd094b

SHA1
999112bc1ba9dc4bf1bcd9825ef8c29e7fef27d1

SHA256
b8e05c0f543ffca22f015aff3b0c121892051f78a5b08a68e533c0552efc43db

SHA512
15092b7e4da9cf4de4b364bc543fde864ca14aa5fb412d0683deded2078f13495d4eb0d304c4540876fa1b0aa93c1baee77b690c71c8d7c4b83e8db96355fa94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
639341fef0c306704706a989e7db583b

SHA1
1d41f45413cd6f4cad41251896fa004432b9b2f0

SHA256
fb62306789ec8f7b6d29c6fbf2b488dfa3726351224193cc3b30f3d544725a0e

SHA512
065cdbf77a44e1ba41cf9cb0f9984e0ddae3b082d1f79f785e23bdaedf7e0f3b2ba81259e29ae314d6ee5063b4237b616f59b26b6c019b3b56be13e36735ae66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
d21210fea922025da9a846c608265abc

SHA1
9f6ca7fc374c2dc8a5d4c8d475364114f6156fa3

SHA256
960eb6aff3de1c72b6dbf79c174165bec1c2c887fee42211fa2b61c750234747

SHA512
c4c936453e03b937a48fc3bc6c0011a4fa4df4b0e9906410876c565ea106743a1322be3038c2396087303de3e691e1d8f2ea3daedf4a24d39d9493e621569600

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
d45dc51c62c50d8cb365bf25b38fe529

SHA1
bfe2122cb1d45857b38fbb213d4a25420a5f0fb3

SHA256
f018b669b3c574250ba50ebf3536765ce21628a563446e67499e7e3b5e29e3ae

SHA512
7a4883caf964f1b2fb44d1b0a6f23774e1e5700c95661eb4d48c7828597f66f1697c5c1f4a2ee080a79480262af83156078059f428e27e1e5b59d0c07c8ab983

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cbb8260bb29af6e4066ec997cdb0f2b1

SHA1
1653ed60e023d6b1dfbec7816031fe51ac8f87e7

SHA256
b6f7197c11f9e25b9f7689ee1a7e12963ec9d355bea93f063c1d572939da2e11

SHA512
741b1b456eb771a9b64b1578b93078ceda95b2b35779a3e23f2397cb1c51616df0363cc95d083b23ab8b53b374d8c0bed683d7bb15ba2cd855f5076d0d96723e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
558b01f200cb22723f9d495d99f7456f

SHA1
2052ba0ad7e544f51994942cabe5233bdcd4733b

SHA256
c7d269d48796a54f30b813d7cd0c508f927e2ede4808fe9cc7f3aa96136e0705

SHA512
f5e0075b730d086d85bb681819ad9b5474708fd12122168d3e5f78ae6b6c43acccd2ced1ddb49cb9f2351101d5c31146f4b7efeeeff253e0395d56d905ff26c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
70b61c55c32b51ad8352350729b0f2c7

SHA1
f586a0937aacaa87309d225ca8286b8b7d145703

SHA256
98d696084b547e6cf296618d9775b1b2395f77d5dc359ef6678a9d852151b6b4

SHA512
2e6f562866254f6a1c958e9d4fb9fe447c350bf5dbc7430cb972e69618441ae797aa7bd2f7ab09313d0c6368e5530dbaf5ee9bf24d0cc53f9d6794ea72f41191

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e228ff1b8b1b97f86cc7e9530c90407e

SHA1
b4f76b6e36a212c08df3a24ecca25c028e3163e0

SHA256
a8e7520ee2d09cd9a9a50ef962c5c7dea609ee9ea67b6591cd0bd36320e1fc85

SHA512
755c0a36555c0799a2ea9a84213045bdc3489e825d3dfdc0f740a02869e8f914c6bbb4dda54b742f12ab538479403d058e65a3cae2198c897d89b601d02c9f49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f1aa6b25cf8a088a61811051f138165a

SHA1
26c278d02f9a9cb03c2d915dc0a3cecafe994d70

SHA256
f4670906b52df1789f8f09bece0176057eb4d8b725ed2ebc2a696a1bdbadd3f3

SHA512
da9ed16e9e8aeceed601efbee9eaa7e83cbcb44a9536bb1e769d5c9e20cecfdba19444db0bb8832fdb3c3f7ec3749839c190b1daf7ceec98ec4bdc914cdb4618

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3cb244a813fb04bb609ee02e7df9cb97

SHA1
1f6fc6e1f00a0577db52402cbc37840269122e46

SHA256
604b6ae142dbee14bcbd03d751e76e36a7739261082a9e51460d4eab8c7f23ad

SHA512
71592c110e364d092c5f622a47af70d577155e0fcc098fd1ae18393e87edeff14d56c60465041e7e361dfe6e8059a65d07f7b826ed264f5f6c8be3cb5866d1bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
852f38cb75028bc11e591bec36faaa77

SHA1
c5e0a92ea38f9237c4108275348880455e9a0988

SHA256
216b5c846329978e9066b6c9d625856ec2a0fade30b7517ef8321893a3b9fa61

SHA512
ec069c1c5ddbb682af97fac0c5486edb2a9250cdadab85d6e3c89b47f5b852953b76fbd7f15b59e4b79ec4d1afa43a0e3779c267514bfa0a87412f11746f6a7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c9540d0be9cc42dd9908d48897f196c3

SHA1
6f5031d7d03e2d7e6d44abab561215ceb32eb1db

SHA256
5806f6149a99815013e28ab70f00f35e06205376c705c2239d16b433c99d130f

SHA512
75f9022fa3ebdf7d820228746e09867838b88cee91e0ed80dba3b7e9dec2ecd258bee82ca32d88db2599a8a2af21eabf1fe98e56be4fdb4c857cf6c964573b48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
60f1e9fb21df5072b319e839bea36053

SHA1
96dbeb4e246b1e9181ba648d840709f132edd9b1

SHA256
7e588a4c7a64786989e13b95c344f29b461a2ac2e8bb305dfeac8c4a61e37781

SHA512
d98cb13d97bd0269abdc4aa80f40113d19a8b63f7303a212dd09974208c3a714892b5c1b3154438fb16e20e534caeb161760ffe93f9ff0909233c5a93bdc34e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
46285ec471742e6a19cf4877c887825c

SHA1
6f5f93e711bc3d6234b5da0b70d5369b14ae7110

SHA256
1a63629c2378e26f88ba41acfec867d1c32ab7fd025dfeca56fe2f3ae0f07f27

SHA512
49a58ddc21ccbb3e97848d08a027b4e6bcf69505eb69a055638fd2a864fe77473fdf9bfdbd10ecf0c38bccb6182b8ec6e230bfbe18c058ab2368315bbcb5e31c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
a41ef960ad7870c50b7e84b12a74075a

SHA1
398b9911444fc9b7b7c772b9964a17268456e354

SHA256
4877ddba911292cde1a128de91f1dd91fa5675cadcb0e4fafa86d7eefc54628f

SHA512
5df8330dc3ecd25948820c8c1efd15793a013c3122feeeb88e56af40b15743fb4b4bef19f1f648b98124404d93f3d7361542a3a27b95fd452b817c9bc5f56924

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
113KB

MD5
d7148b9c520292973eea9694bf8910ea

SHA1
a6a3a6ab1692be79fc60149ee4b5b0edb33a18ac

SHA256
3538a38132e786fd63013b29271bccb0266481764ab2abaa252059e46a185e58

SHA512
19a85e099d6f1ada2791c7f815b8ffcb43b7c5ea18658a17f100d85369df54195dd22c9da6e5cea052d550b9c8d8d2864037e1b423768f4db8f36893ce99c0b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
104KB

MD5
a2823f4ddb013844381ac99ec8ece62e

SHA1
1a2d33e3886e7a86b3f1092aeda5de4fff53034a

SHA256
ea3a0405c2db9bdebb3b75fea44835199c4fb4374096ea5bd57e983bb8447a94

SHA512
214e64aa9209f3708782f8203ea0ded447addb9130b9cdab93460cf74a858a198228860c469ccb4b1250ae94923679c914d0aaeb7a6bc5e6633be4b2675304ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe589b60.TMP

Filesize
102KB

MD5
570ece3949b1e96f7612e7f2a3645078

SHA1
6359eeec240a69268ce5e35026a7b779c94c4b4b

SHA256
31cd6981b489364d258aba768cc616169e81691d95a1eecfe1a63744d3e66ba4

SHA512
d0d8891b54f54f3f5313dc950a91e70e77d0ee4d2aaa37c1604e49598649374c2f75f60763e4bd8d7915cd084d557730354d0a11e2e76fbb648003bce714aa4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a2dd3490-a639-4be1-a942-28b136f93ce7.tmp

Filesize
136KB

MD5
34438d06e940b9f5be09be752fa2667d

SHA1
d257f937818848569e3d430c519e22cf88bdf304

SHA256
9cc9abf77b9a427c0a2f264c5f79ad113657c7739a20ac0c566c593847f3fab8

SHA512
ebf006a00f530518ede53fb2370880ea69df46fa570c57bd30e2fe0da1b35d520a5ef36ca56df59d95429b35c31f9630ad2e15a6b876353c4d14f350f62d4fd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2TT8RSZ7\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3AM86EZ9\bootstrap-icons.min[1].css

Filesize
68KB

MD5
e8f9bf6bffd8e881edf8d6880608421f

SHA1
7712bcd53b975e0ec26af2af51c2098ff5bd25d8

SHA256
ee16c135f599c64d3ae35ed65466b5ae1f91d2bac858f8701b76213565a0e664

SHA512
633c0680574ed4d430d426643e81b2464127513c4f49b1965ef1a25eb5a4f08792a9dc9c8b47440d874b2e3331ab5cc2a14d1005ae241c016246150bdf3d9ba3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3AM86EZ9\bootstrap.min[1].css

Filesize
188KB

MD5
6d9c6fda1e7087224431cc8068bb998f

SHA1
6273ac1a23d79a122f022f6a87c5b75c2cfafc3a

SHA256
fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf

SHA512
a3f321a113d52c4c71663085541b26d7b3e4ced9339a1ec3a7c93bff726bb4d087874010e3cf64c297c0ddd3d21f32837bc602b848715eadd8ef579bfe8e9a9a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\DMNDNZ02\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3AM86EZ9\KRNL-NEW_PIK10OgKA7[1].zip

Filesize
5.9MB

MD5
2b7afe332dee46d9e5a26eea083fa3ea

SHA1
0c818aad8bd1319648492f87343fa5071c5bc17f

SHA256
56cec9c9b87a325c4990e3ec9946c166fb02b1dba9a8aaed67fd5f14d080a4e4

SHA512
4d56d47963187a06b317bc523412ee7d33afce3f73235cf02ddd9a27e7d832d301945e8a5f515bfe188e159b69afd3feaa275b4404e38debcf63bbee0f0354a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hkgpvplt.3em.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0EGH.tmp\KRNL-NEW_PIK10OgKA7.tmp

Filesize
692KB

MD5
9117626ad0c0177cf9453ca5b332aa27

SHA1
a3e1fc9c8d77d0a1de1993fad2584161ec938fc6

SHA256
f4355bb824b0d25711fd1a2003bbf123ee649d447fc214ef154fe9882d789a15

SHA512
4ee6b6357e478bb66a2c58a18194bf006382c82a8eb1f6782184420d272566c6680bc48903d129b8010f1404805ea975521358151fb2766174e58773a965cae2

Download Submit
C:\Users\Admin\AppData\Local\Zoom Player Plugin\zoomplayerplugin.exe

Filesize
3.6MB

MD5
9160530a73bdd856b82bb2ed56d0ca6e

SHA1
8dfb2cc0c4d8d39bc966f3b93934f3a17070c337

SHA256
14e728ab6e8ed896e49facbaba1a0a5fba23129854ad9f5cebe0d1f2e4c17728

SHA512
2574d229d6224b97532720c34ba3ecb4fef7f065e3f8f8803ff708aadd2c2745151642c74dc0f2ae89ed89b2eab59d79cd0ef35f2c4a70b705414f3aaaeb10e4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
10KB

MD5
1ccfcebab650e6d0d9a2714ffd269c7f

SHA1
3b3d59366999c517827f89014ff986fd51d5539b

SHA256
20d69b5360e36339158c1282996a25dbcde3ac79b5d7bd6184cbeddb0db280a3

SHA512
5b13992f927f56d9f55f29e565a9ab0057a9f0c83541f60c3a1e8235eefad019c799ef6f066ba392e5685511d617d2e50121e319d4eadf4222baf868b833837b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
8KB

MD5
d325b8f75095d5a3d3bd62feaaf4bbe4

SHA1
e45b6eb0ab38a91359150290f8d9702edfff8034

SHA256
3dcdc1d0c876c977b2ca73a88e311a83113be1149872b9266fc496e7e3adb492

SHA512
e835a9b414078bb104f8877d159ce2056f32cf3cb3d5f12db2f6b0cd802daa61b259bc1091b510b3c3127c7566a4d8dd036349ea0a6443ceb63249edf9ebb917

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
10KB

MD5
28a5375c0811e25b2cf80c89a60d8d44

SHA1
4e30a8878dee3cd995afda7b5c5fa15caf3ea84a

SHA256
c02d37f4d9a8a57751bd83a41ee74c43429c44281ca8c9cd31144237eaee34c0

SHA512
2a4807a4f9ea8053f4055ab4024a72af82a24e46dd68230dd1b2a95354290d1d6ab5d2c59dc33d644793580084da01e010c7a40d6264988c18ee2e16744fe447

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
9KB

MD5
e00df5514332fd7aa3d5ec64673f0e5c

SHA1
68341178c6effe3baf5bfe38c459c93a2a7ad4c9

SHA256
8824bf70aa5b55bec4b0c306172e8a161d0b8cffe5ce7d2ed00425331cde1a87

SHA512
edb89704727b7a3ddb41f61a95203a38cc9c05bcbf51850417a2ebf2601dbb06dcb8f5abb21c198f029890db4ff892802dbab72ad6adbbdfd5a4ef8306b6b6d9

Download Submit
\Users\Admin\AppData\Local\Temp\is-EIB6N.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-EIB6N.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
memory/1944-733-0x0000000007F20000-0x0000000007F6B000-memory.dmp

Filesize
300KB

Download
memory/1944-730-0x0000000007BD0000-0x0000000007BEC000-memory.dmp

Filesize
112KB

Download
memory/1944-719-0x00000000077C0000-0x0000000007B10000-memory.dmp

Filesize
3.3MB

Download
memory/1944-716-0x0000000007750000-0x00000000077B6000-memory.dmp

Filesize
408KB

Download
memory/1944-715-0x00000000076E0000-0x0000000007746000-memory.dmp

Filesize
408KB

Download
memory/1944-714-0x0000000006EE0000-0x0000000006F02000-memory.dmp

Filesize
136KB

Download
memory/1944-710-0x00000000048A0000-0x00000000048D6000-memory.dmp

Filesize
216KB

Download
memory/2144-734-0x0000000008B30000-0x0000000008BA6000-memory.dmp

Filesize
472KB

Download
memory/2144-713-0x00000000079F0000-0x0000000008018000-memory.dmp

Filesize
6.2MB

Download
memory/2396-659-0x0000000000400000-0x0000000000B9E000-memory.dmp

Filesize
7.6MB

Download
memory/2396-658-0x0000000000400000-0x0000000000B9E000-memory.dmp

Filesize
7.6MB

Download
memory/2428-565-0x000001742F200000-0x000001742F338000-memory.dmp

Filesize
1.2MB

Download
memory/2428-348-0x0000017427D20000-0x0000017427D30000-memory.dmp

Filesize
64KB

Download
memory/2428-364-0x0000017427E20000-0x0000017427E30000-memory.dmp

Filesize
64KB

Download
memory/2428-664-0x000001742EDE0000-0x000001742EDE1000-memory.dmp

Filesize
4KB

Download
memory/2428-663-0x000001742EDD0000-0x000001742EDD1000-memory.dmp

Filesize
4KB

Download
memory/2428-383-0x00000174252C0000-0x00000174252C2000-memory.dmp

Filesize
8KB

Download
memory/4516-412-0x00000177A6DB0000-0x00000177A6DB2000-memory.dmp

Filesize
8KB

Download
memory/4516-415-0x00000177A6DE0000-0x00000177A6DE2000-memory.dmp

Filesize
8KB

Download
memory/4516-431-0x00000177B8390000-0x00000177B8392000-memory.dmp

Filesize
8KB

Download
memory/4516-417-0x00000177A70B0000-0x00000177A70B2000-memory.dmp

Filesize
8KB

Download
memory/4516-429-0x00000177B8370000-0x00000177B8372000-memory.dmp

Filesize
8KB

Download
memory/4516-439-0x00000177B8530000-0x00000177B8532000-memory.dmp

Filesize
8KB

Download
memory/4516-435-0x00000177B83C0000-0x00000177B83C2000-memory.dmp

Filesize
8KB

Download
memory/4516-433-0x00000177B83B0000-0x00000177B83B2000-memory.dmp

Filesize
8KB

Download
memory/4516-486-0x00000177B8E00000-0x00000177B8F00000-memory.dmp

Filesize
1024KB

Download
memory/4924-395-0x000001AC88E00000-0x000001AC88F00000-memory.dmp

Filesize
1024KB

Download
memory/5704-583-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download