Resubmissions

05-06-2024 15:48

240605-s8zxpsbb5y 1

Analysis

  • max time kernel
    1050s
  • max time network
    463s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 14:27

General

  • Target

    873d16767e0895ff109b2a2ae61335f5_JaffaCakes118.html

  • Size

    175KB

  • MD5

    873d16767e0895ff109b2a2ae61335f5

  • SHA1

    15ce4fd25f2709f3a3379a41e51337ddfa6c773c

  • SHA256

    77da860cd56ac35ea77e4768745a0c36a3662ad08fca31aa6a5ab1cec5c3d4e0

  • SHA512

    280efb73feb2b569444212a708be2e1d9432752ececc7302f4841235c6d76f3d50f2732f12d867b289f9c881a282abf5709918435344d91948ee7570a2d436f5

  • SSDEEP

    1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS34GNkFjYfBCJisl+aeTH+WK/Lf1/hmnVSV:SBoT34/F6BCJiZm

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Manipulates Digital Signatures 1 TTPs 64 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Modifies AppInit DLL entries 2 TTPs
  • Modifies Installed Components in the registry 2 TTPs 64 IoCs
  • Registers new Print Monitor 2 TTPs 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 62 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 1 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies WinLogon 2 TTPs 64 IoCs
  • AutoIT Executable 46 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 20 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Control Panel 64 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 41 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:1736
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:3452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\873d16767e0895ff109b2a2ae61335f5_JaffaCakes118.html
          2⤵
          • Enumerates system info in registry
          • NTFS ADS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbb1b46f8,0x7ffbbb1b4708,0x7ffbbb1b4718
            3⤵
              PID:392
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
              3⤵
                PID:4224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2480
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
                3⤵
                  PID:2828
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
                  3⤵
                    PID:4612
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                    3⤵
                      PID:4540
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                      3⤵
                        PID:4636
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                        3⤵
                          PID:100
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
                          3⤵
                            PID:5060
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
                            3⤵
                              PID:3688
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
                              3⤵
                                PID:3900
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4868
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
                                3⤵
                                  PID:4128
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
                                  3⤵
                                    PID:3132
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                                    3⤵
                                      PID:5084
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                                      3⤵
                                        PID:1020
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
                                        3⤵
                                          PID:848
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                                          3⤵
                                            PID:1936
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
                                            3⤵
                                              PID:2904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                                              3⤵
                                                PID:5356
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=180 /prefetch:8
                                                3⤵
                                                  PID:5600
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5964 /prefetch:8
                                                  3⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5608
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
                                                  3⤵
                                                    PID:5904
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
                                                    3⤵
                                                      PID:5392
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
                                                      3⤵
                                                        PID:5548
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6688 /prefetch:8
                                                        3⤵
                                                          PID:5384
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                                                          3⤵
                                                            PID:4420
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7192 /prefetch:8
                                                            3⤵
                                                              PID:5560
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
                                                              3⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:5920
                                                            • C:\Users\Admin\Downloads\Gas.exe
                                                              "C:\Users\Admin\Downloads\Gas.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:5452
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
                                                              3⤵
                                                                PID:2560
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7656 /prefetch:8
                                                                3⤵
                                                                  PID:5664
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7476 /prefetch:8
                                                                  3⤵
                                                                    PID:1228
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,14545365889916017173,6438512220342105535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6692 /prefetch:8
                                                                    3⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5240
                                                                  • C:\Users\Admin\Downloads\VeryFun.exe
                                                                    "C:\Users\Admin\Downloads\VeryFun.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • Drops file in Windows directory
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1368
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe"
                                                                      4⤵
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1064
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe"
                                                                      4⤵
                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                      • Modifies WinLogon for persistence
                                                                      • Manipulates Digital Signatures
                                                                      • Modifies Installed Components in the registry
                                                                      • Checks computer location settings
                                                                      • Adds Run key to start application
                                                                      • Checks whether UAC is enabled
                                                                      • Installs/modifies Browser Helper Object
                                                                      • Maps connected drives based on registry
                                                                      • Modifies WinLogon
                                                                      • Sets desktop wallpaper using registry
                                                                      • Checks SCSI registry key(s)
                                                                      • Modifies Control Panel
                                                                      • Modifies Internet Explorer settings
                                                                      • Modifies Internet Explorer start page
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:2088
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe"
                                                                      4⤵
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5320
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe"
                                                                      4⤵
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2872
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe"
                                                                      4⤵
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:708
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe"
                                                                      4⤵
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5228
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe"
                                                                      4⤵
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2844
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:532
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:3400
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:4196
                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                      C:\Windows\system32\AUDIODG.EXE 0x330 0x32c
                                                                      1⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2984
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Modifies Installed Components in the registry
                                                                      • Drops file in System32 directory
                                                                      • Sets desktop wallpaper using registry
                                                                      • Checks SCSI registry key(s)
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:452
                                                                      • C:\Windows\System32\ie4uinit.exe
                                                                        "C:\Windows\System32\ie4uinit.exe" -UserConfig
                                                                        2⤵
                                                                        • Drops file in Program Files directory
                                                                        • Drops file in Windows directory
                                                                        • Modifies Internet Explorer Protected Mode
                                                                        • Modifies Internet Explorer settings
                                                                        PID:312
                                                                        • C:\Windows\System32\ie4uinit.exe
                                                                          C:\Windows\System32\ie4uinit.exe -ClearIconCache
                                                                          3⤵
                                                                            PID:3636
                                                                            • C:\Windows\system32\RunDll32.exe
                                                                              C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                                                              4⤵
                                                                                PID:6064
                                                                              • C:\Windows\system32\RunDll32.exe
                                                                                C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                                                                4⤵
                                                                                  PID:6072
                                                                            • C:\Windows\System32\unregmp2.exe
                                                                              "C:\Windows\System32\unregmp2.exe" /FirstLogon
                                                                              2⤵
                                                                                PID:4488
                                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
                                                                                2⤵
                                                                                  PID:3656
                                                                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff70595ae48,0x7ff70595ae58,0x7ff70595ae68
                                                                                    3⤵
                                                                                      PID:5272
                                                                                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=2 --install-level=0
                                                                                      3⤵
                                                                                        PID:2708
                                                                                        • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff70595ae48,0x7ff70595ae58,0x7ff70595ae68
                                                                                          4⤵
                                                                                            PID:3132
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge
                                                                                        2⤵
                                                                                        • Drops file in Program Files directory
                                                                                        PID:5904
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6667a5460,0x7ff6667a5470,0x7ff6667a5480
                                                                                          3⤵
                                                                                            PID:5396
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --migrate-edgeuwp-taskbar-shortcut
                                                                                            3⤵
                                                                                              PID:5900
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbb1b46f8,0x7ffbbb1b4708,0x7ffbbb1b4718
                                                                                                4⤵
                                                                                                • Checks processor information in registry
                                                                                                • Enumerates system info in registry
                                                                                                PID:5864
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -u -p 452 -s 2564
                                                                                            2⤵
                                                                                              PID:3540
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                            • Drops file in System32 directory
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Modifies registry class
                                                                                            PID:2376
                                                                                          • C:\Windows\System32\spoolsv.exe
                                                                                            C:\Windows\System32\spoolsv.exe
                                                                                            1⤵
                                                                                            • Registers new Print Monitor
                                                                                            • Drops file in System32 directory
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:2156
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -u -p 2156 -s 2104
                                                                                              2⤵
                                                                                                PID:4236
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                              • Drops file in System32 directory
                                                                                              • Checks SCSI registry key(s)
                                                                                              • Modifies registry class
                                                                                              PID:692
                                                                                            • C:\Windows\System32\spoolsv.exe
                                                                                              C:\Windows\System32\spoolsv.exe
                                                                                              1⤵
                                                                                                PID:4188
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4188 -s 644
                                                                                                  2⤵
                                                                                                    PID:628
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  • Modifies registry class
                                                                                                  PID:1384

                                                                                                Network

                                                                                                MITRE ATT&CK Matrix ATT&CK v13

                                                                                                Persistence

                                                                                                Boot or Logon Autostart Execution

                                                                                                7
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                5
                                                                                                T1547.001

                                                                                                Winlogon Helper DLL

                                                                                                2
                                                                                                T1547.004

                                                                                                Browser Extensions

                                                                                                1
                                                                                                T1176

                                                                                                Privilege Escalation

                                                                                                Boot or Logon Autostart Execution

                                                                                                7
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                5
                                                                                                T1547.001

                                                                                                Winlogon Helper DLL

                                                                                                2
                                                                                                T1547.004

                                                                                                Defense Evasion

                                                                                                Modify Registry

                                                                                                13
                                                                                                T1112

                                                                                                Subvert Trust Controls

                                                                                                1
                                                                                                T1553

                                                                                                SIP and Trust Provider Hijacking

                                                                                                1
                                                                                                T1553.003

                                                                                                Discovery

                                                                                                Query Registry

                                                                                                7
                                                                                                T1012

                                                                                                System Information Discovery

                                                                                                6
                                                                                                T1082

                                                                                                Peripheral Device Discovery

                                                                                                2
                                                                                                T1120

                                                                                                Command and Control

                                                                                                Web Service

                                                                                                1
                                                                                                T1102

                                                                                                Impact

                                                                                                Defacement

                                                                                                1
                                                                                                T1491

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\a44218f6-c1d5-42b9-a4df-dd418603e6b3.tmp
                                                                                                  Filesize

                                                                                                  488B

                                                                                                  MD5

                                                                                                  6d971ce11af4a6a93a4311841da1a178

                                                                                                  SHA1

                                                                                                  cbfdbc9b184f340cbad764abc4d8a31b9c250176

                                                                                                  SHA256

                                                                                                  338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

                                                                                                  SHA512

                                                                                                  c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                                  Filesize

                                                                                                  150B

                                                                                                  MD5

                                                                                                  cea14e3018403bd974827f4b76271b6a

                                                                                                  SHA1

                                                                                                  980487ce777d3579396f89de5a13376a39b7a5c5

                                                                                                  SHA256

                                                                                                  951c4a77b2f6ccb9ff8f4e2dd5074859577ecec0eb56b4352186a6a87283f56e

                                                                                                  SHA512

                                                                                                  aca3195d3626ccf60159b9ad895eb87d1b1a33cbe8cdaa1c0076d1aab094367729473cfdc596cf7105df2894bb9f60408dd7aed9c4821c9567329868db6864b6

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\688d120d-ba0b-4482-94d0-547fb8b298f5.dmp
                                                                                                  Filesize

                                                                                                  5.0MB

                                                                                                  MD5

                                                                                                  f15b6352981d2c8eeb827c90a0632eae

                                                                                                  SHA1

                                                                                                  25e7539c2b3530e941f770efb27b473162e52a1a

                                                                                                  SHA256

                                                                                                  3189b34cf293a2f0a897eb2a9379b663c3d59241e5137fdaf4322f3712e6ffcb

                                                                                                  SHA512

                                                                                                  b116aaec5e56961f24ee58096a462703fa50acfb82582da3b959b4de8576e8ca44ae001c9b4a78caa9d840c5555cacfb77f70d8c0040fae264f7e759e3a83f55

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  1ac52e2503cc26baee4322f02f5b8d9c

                                                                                                  SHA1

                                                                                                  38e0cee911f5f2a24888a64780ffdf6fa72207c8

                                                                                                  SHA256

                                                                                                  f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

                                                                                                  SHA512

                                                                                                  7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  b2a1398f937474c51a48b347387ee36a

                                                                                                  SHA1

                                                                                                  922a8567f09e68a04233e84e5919043034635949

                                                                                                  SHA256

                                                                                                  2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

                                                                                                  SHA512

                                                                                                  4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  4ae558d9a60b658bbaca0fea1f96e6ed

                                                                                                  SHA1

                                                                                                  fc97b01845924cc27c43d658e6f068a1ef17bb31

                                                                                                  SHA256

                                                                                                  f76c65d0fb316e5e0245e4a320a352e85cb97ec168e742e6f95bf7b70cc89a83

                                                                                                  SHA512

                                                                                                  450f406c52a3088e59923fc717222891a7f257b5b5864b4811de23e8ab7b06f9155111662052d5c4a92884a71b6043805190af2e1d1b3572e8507b4ba5851f3b

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32dc7ddb-2f0d-4d5e-b283-66f178b52d8b.tmp
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  da8fb5ee8098341ca1b469f7c20c9a53

                                                                                                  SHA1

                                                                                                  a2555ad238aa381f705772456a7d68ab7b3fc7a6

                                                                                                  SHA256

                                                                                                  fc6a04b6f815cf0368f8d275b014f8aae69dc3a9a15c6177d1d1f1c69b4f8b42

                                                                                                  SHA512

                                                                                                  ebec14f5b2b8e59bc77b8e534d17ba2f0c79a9427ab435c6ba243fa0a65e82329ff4a7e5c170140da12c4dc7548bcca99164c4b21d1e6543811dc2891e7bb36d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  c7246c5f82cb91187e6f792f227d8378

                                                                                                  SHA1

                                                                                                  45b71c5143d0c710ddf714446d48e4894069a0f5

                                                                                                  SHA256

                                                                                                  d29c7828391ce7c95839b6dae4a7f1c0fcaa411b5a8daf254be7ad27e1ae7c7a

                                                                                                  SHA512

                                                                                                  a2d00c5e899481eabd7d85c5df3aa6920399b85a61c5079c33f0de1c5daa3833aa01d2d1fa3536d71f5c506965c63c7cfd859b1b7b5d29d5d6deee775c993e56

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  3e09c1d16fc55edeb70ef79689b116a9

                                                                                                  SHA1

                                                                                                  3ec7ef888ff138379bc176db25534e04cfc105a6

                                                                                                  SHA256

                                                                                                  8c5bc3f42585f88b8b241451a58c0c6742e8bf374319620cddadfa59904625be

                                                                                                  SHA512

                                                                                                  ea8f8931243f205ff1e65125b23ecf9b6ea710c55e35f50606553ebe49deea09a5af8638c6497c1c9a9d5b095a1b45597ac9fa6cac1b09387ade504cd1d777b9

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  b7193480ab2a66105691e9f0a374ffaf

                                                                                                  SHA1

                                                                                                  3070da540291400fbb0c7aac1cb3ae0e70cbc5cf

                                                                                                  SHA256

                                                                                                  6d1a1904241c51dce0ef634725618ae968ff85cf3b28f340f4e1100b30c1a3ed

                                                                                                  SHA512

                                                                                                  3542c2737a1f0ee4d606fb3854e97fc2e1a38b60725437316f9f0458399cf9285726a14f61caedb8ae2d9cd77e9968bbf1af525e73be0a9a5ed99a86a2999338

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  cf4cd8d2282702b4d092ac26464c821e

                                                                                                  SHA1

                                                                                                  c4d235b1bf935a0b4adbefb25af00b51c5bdbf93

                                                                                                  SHA256

                                                                                                  24dfe6befd6e1ee05160ac284b9f77a42e035f8fbe992f6d45096271eb0659e4

                                                                                                  SHA512

                                                                                                  dede062f4953b6bfa561d4bfc09b671061aff655aad006bcf12278ae68fe57466833970f004c84d1de108f9f2471fab692cd940e74f4f5a50f94b384cadb9448

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  b213b7731632404609ab111ced903dac

                                                                                                  SHA1

                                                                                                  61b90d7f87ca3b63d8b33922e61246627f4f37f9

                                                                                                  SHA256

                                                                                                  292e399773924aafab2e07d242fd9ef0ec731a12e9caebba94d7c14469a55567

                                                                                                  SHA512

                                                                                                  faa5c6d471950eab0412fded482e977c2e184aa68408582256d8e68747770331f05a292a881ac747b9cb8706b75f35f0764da3d7ec7f22732d0a9d05f9ba7e97

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  5KB

                                                                                                  MD5

                                                                                                  5b29a375c0feaec5b4b0814f8048488e

                                                                                                  SHA1

                                                                                                  8cc3dfd3d0e9e8e06305fa5c52c7f62b113e9e75

                                                                                                  SHA256

                                                                                                  6bb054701398e6837eecb2222d486d95b63e1913dcb0da83618e08926498a4e6

                                                                                                  SHA512

                                                                                                  6952eadc8d345e445a3814574c33c02730b5c9e8152a482bd243d0dc69ef4a2df3160db0565a71ec099d4dfc1f1a35868eacb59ba5996d286a90f0d0cafa8a00

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  7KB

                                                                                                  MD5

                                                                                                  57dcdf5e786cb896d40adc40451fb921

                                                                                                  SHA1

                                                                                                  4629d0280abf4db9d5752fd5a8d1a3ebfa012843

                                                                                                  SHA256

                                                                                                  8eb62b55a85f447cbedb9340611f6087330ebb2975582182fd20d9a82dbc5082

                                                                                                  SHA512

                                                                                                  769cde9ceda54a914d82e2ff3387630dc3b7034506d074710b745685788f6e3769b4d360961563ea1b9452910afb0d1b637c3c2c805d12aa9a174cb4083d5a58

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  9597f61d2432bc3850b296bc51767da2

                                                                                                  SHA1

                                                                                                  0441bd4c39fcf328b86de747c14fb259d3a79541

                                                                                                  SHA256

                                                                                                  074f1cc4e94a4ef7059061981d7a201d83abb60d7a7bf349e00f98e99ee79fb9

                                                                                                  SHA512

                                                                                                  e1c04c3bf9374a6faf75a9a76093a00cd8509fd20dff6a8869386d8dbdbace55897a0ddaf133d33564dcb9cb5dfac091bb08a4d6a1f927133e671854bc8edb8b

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  391587496889bd8ffc44d3c99d4ecf84

                                                                                                  SHA1

                                                                                                  d758d952e557e4aad1dfcde76d5a000d29ab00a5

                                                                                                  SHA256

                                                                                                  ae171d946dc011994baafcb99093d032cd8c3d02efde31b88ae8d788e16f1bad

                                                                                                  SHA512

                                                                                                  fc171f43a0d7ceaa881d8ec763ff4b1ca25f3b824efd5a8f98146c0dcb8c6f3d9002453b18ba3e23ab26797fcd1252f655df09bae29a82a79cd32df4820fbe40

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  a9d1ad9a31fd0e2195a9ac10e9afba28

                                                                                                  SHA1

                                                                                                  b787aacfc93cd71adced30171ce8f44e48585ea8

                                                                                                  SHA256

                                                                                                  83600a7eb5a06c2d5654e92eaeeb34cc3877773d07892fa5f9b5176f314eb5ad

                                                                                                  SHA512

                                                                                                  6d229bfcc8e336f03dd6a31c9f140ffe1325440dde191189264af5e884ebf835b90a03187ba35337ae9c1ac55434de6746e0d2fe276784a042d58d59132d130f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  00418dec65c6b1a8242d7107657241b0

                                                                                                  SHA1

                                                                                                  e33a76bf57090f010032973bb280b31107fa3a2c

                                                                                                  SHA256

                                                                                                  71acecf99e17dd6bc1bd8364e2b75d6126cc8a8d65510858493c0cf2796b8f9d

                                                                                                  SHA512

                                                                                                  c227eba86a36bf4cf24d655910d7bad0d94a7e8202fb6c0f0cc08e77d6112892225f640d6663b9cd259552712c896354f5c738b9d311dd8541769f98a0b608d3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  cce9b02d869c024309b4981220e48462

                                                                                                  SHA1

                                                                                                  04332ad95c97beddf3013f4b566c2c03934249ba

                                                                                                  SHA256

                                                                                                  1816a9b3a5e31c64a678b9e8f5d892e1bf8fa0c708246dbcf4ad72666f0f2cf9

                                                                                                  SHA512

                                                                                                  98ac692a5db144583df0130f6194f21fa9fd7ef7d877dce4751543d26119538302fe55e4474a311704a762cc852a7de54ab55de9ce37d7736ae1c21d76cbfd08

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  632cb4a87db416a2c5defc8e6c330b1e

                                                                                                  SHA1

                                                                                                  27f5f4451fcc98ab0d0d72fb47afe56cc63cf525

                                                                                                  SHA256

                                                                                                  3ff3245d4181e30da929d51f8877e06c0de1709fe6d27c982edbcef2724b3524

                                                                                                  SHA512

                                                                                                  ceceb0f62d9dc7f3d714f1c85b3a04820878fcd8f4a71ee21ad88532a0a9c8740574e604304785dd723b742ee35e10e5405e39477f6b72cc025f59be3f2ae2ed

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  372B

                                                                                                  MD5

                                                                                                  ccd6fc1563147d146475613e8bc305a6

                                                                                                  SHA1

                                                                                                  d37ddf43f5eba178ad84d2f0e0f6918b0b9ecccd

                                                                                                  SHA256

                                                                                                  4a2111dd4385c3e83a9e7a2c8628ee0f6551decaccbb6ffabcafb31d5785c3db

                                                                                                  SHA512

                                                                                                  c58c7dbf2c6baeefd9b63ab714b23cf7e033dd4998994fb331c75b6e074fcfe5f26c772e3eca127580b3df35024a7a5bf418359cc587f7f57de69a36a111c53c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  874B

                                                                                                  MD5

                                                                                                  5effe9959fe4b1f4e8b10cb0cbdabd50

                                                                                                  SHA1

                                                                                                  9ed7b9bb777bd161011061f4c476a0c9b64bde71

                                                                                                  SHA256

                                                                                                  8e7654f25ab2347b353f0c12cf2d75a1611cd1a9a0ac5bd1ef3421d8f61c5ea7

                                                                                                  SHA512

                                                                                                  34404c33fe73673e8feb8b27ddd078e8cb00edd3ca8bd8ffe681a84738c8454591af003c8e96c46071b201488b33e277c6807f19b88966c0da02728eefcad125

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                  SHA1

                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                  SHA256

                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                  SHA512

                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  063de420474ccf0ca1c8331972c61440

                                                                                                  SHA1

                                                                                                  4db9ff8636c084618a0ee2e03c14f3460df2a503

                                                                                                  SHA256

                                                                                                  09d2df40a8bf9f00ce8801596e7bd5bfdc56ebcbb17e858b78b890669b650713

                                                                                                  SHA512

                                                                                                  bea69b72bc779eccb194fa582c2292839fb686075e6e3359103d5faba7f04a88f5037ae1627ef1766b865c7376217ed195733fed21755286d083fc8e70a7c94e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  064ef2a46bbe9e5f3ec6d20376060870

                                                                                                  SHA1

                                                                                                  428492fac4b72d65f65b3df28e3e5ce67be7e385

                                                                                                  SHA256

                                                                                                  c3bdb02e0090b611740730198aaef40635ed19adae6108360c1dfabb7acadc79

                                                                                                  SHA512

                                                                                                  5e395ce8d62d32f7ce15697a2a110e8e820cc9ed3ceb5817eeef6d857aaaf076c6d09943a7a00f483949c61645a91442afa36355d4ff24a0d0de1e56476dcf06

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  a69a45a58b70859b8a54835e0f979c32

                                                                                                  SHA1

                                                                                                  4c2f87efaf6b4185a2c164574bc88068ce815b8c

                                                                                                  SHA256

                                                                                                  d981d2c5071f4f1a05ee3396ba5a43f6f2fe35fd15b84556a97aae48fa57b077

                                                                                                  SHA512

                                                                                                  4535c49b7f2c25caa4ad115714ead3b069f85703e0ad6f6e717c0961f0372735a3ece9dac652d0b0b922ed7bccb7a97c407e635027c84725b3d514ed11851bc8

                                                                                                • C:\Users\Admin\AppData\Local\Temp\RGI1B2F.tmp
                                                                                                  Filesize

                                                                                                  24KB

                                                                                                  MD5

                                                                                                  dd4f5026aa316d4aec4a9d789e63e67b

                                                                                                  SHA1

                                                                                                  fe41b70acbcba7aa0b8a606fe82bcfde9a7bf153

                                                                                                  SHA256

                                                                                                  8d7e6cee70d6035c066b93143461d5f636e144373f5c46bc10a8935d306e0737

                                                                                                  SHA512

                                                                                                  3f18e86d8d5119df6df0d914ebf43c1a6dadb3fdeff8002940a02d0a3d763e779068a682ee6bafe650b6c371d4be2e51e01759ec5b950eef99db5499e3a6c568

                                                                                                • C:\Users\Admin\AppData\Local\Temp\RGI1B52.tmp
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  a828b8c496779bdb61fce06ba0d57c39

                                                                                                  SHA1

                                                                                                  2c0c1f9bc98e29bf7df8117be2acaf9fd6640eda

                                                                                                  SHA256

                                                                                                  c952f470a428d5d61ed52fb05c0143258687081e1ad13cfe6ff58037b375364d

                                                                                                  SHA512

                                                                                                  effc846e66548bd914ad530e9074afbd104fea885237e9b0f0f566bd535996041ec49fb97f4c326d12d9c896390b0e76c019b3ace5ffeb29d71d1b48e83cbaea

                                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  9d42087a98cb3a512c29530ce30d83d0

                                                                                                  SHA1

                                                                                                  e1920c6aa415cb50cad562a6160dd27393f08f30

                                                                                                  SHA256

                                                                                                  1582365296067622a395d7ddc81f0456ec486e4ecf489e120a6a489f499034f6

                                                                                                  SHA512

                                                                                                  911bc6ba5a901b82137430b79c4a4d01497c768c075496cc9a69f3534cb00349ca2a91bc80b42691036ebb530699636a046eebeea8369da8b33a8ce9a0c236ba

                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 188087.crdownload
                                                                                                  Filesize

                                                                                                  18KB

                                                                                                  MD5

                                                                                                  e7af185503236e623705368a443a17d9

                                                                                                  SHA1

                                                                                                  863084d6e7f3ed1ba6cc43f0746445b9ad218474

                                                                                                  SHA256

                                                                                                  da3f40b66cc657ea33dbf547eb05d8d4fb5fb5cf753689d0222039a3292c937a

                                                                                                  SHA512

                                                                                                  8db51d9029dfb0a1a112899ca1f1dacfd37ae9dec4d07594900c5725bc0f60212ab69395f560b30b20f6e1dffba84d585ef5ae2b43f77c3d5373fe481a8b8fc3

                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 29886.crdownload
                                                                                                  Filesize

                                                                                                  3.0MB

                                                                                                  MD5

                                                                                                  ef7b3c31bc127e64627edd8b89b2ae54

                                                                                                  SHA1

                                                                                                  310d606ec2f130013cc9d2f38a9cc13a2a34794a

                                                                                                  SHA256

                                                                                                  8b04fda4bee1806587657da6c6147d3e949aa7d11be1eefb8cd6ef0dba76d387

                                                                                                  SHA512

                                                                                                  a11eadf40024faeb2cc111b8feee1b855701b3b3f3c828d2da0ae93880897c70c15a0ee3aeb91874e5829b1100e0abafec020e0bf1e82f2b8235e9cc3d289be5

                                                                                                • C:\Windows\TEMP\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  40B

                                                                                                  MD5

                                                                                                  95c33cc1969930fefbdb95f99b2a9882

                                                                                                  SHA1

                                                                                                  cd2cd226b2c6f6de0bb090f9ffadb8e643a23970

                                                                                                  SHA256

                                                                                                  53b715becb7434a9ec7cebf218a7397d5c30fb50f6d3ac578728024f00ba194e

                                                                                                  SHA512

                                                                                                  c5992c3d6c1d20ed54d7e8cee2d3ac42d929812b770ae770881b4d09475b23cdd5afb323f401ca81bee5566f09638581f8e86b717bfdaf11596e7398978070d6

                                                                                                • \??\pipe\LOCAL\crashpad_1592_KXLDRFHBKRVBZVZH
                                                                                                  MD5

                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                  SHA1

                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                  SHA256

                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                  SHA512

                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                • memory/452-866-0x0000000002E20000-0x0000000002E21000-memory.dmp
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                • memory/708-797-0x0000000000F00000-0x000000000100C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/708-799-0x0000000000F00000-0x000000000100C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/708-798-0x0000000000F00000-0x000000000100C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/1064-643-0x0000000010000000-0x0000000010013000-memory.dmp
                                                                                                  Filesize

                                                                                                  76KB

                                                                                                • memory/1064-645-0x0000000010000000-0x0000000010013000-memory.dmp
                                                                                                  Filesize

                                                                                                  76KB

                                                                                                • memory/1064-646-0x0000000010000000-0x0000000010013000-memory.dmp
                                                                                                  Filesize

                                                                                                  76KB

                                                                                                • memory/1064-642-0x0000000000D00000-0x0000000000E9C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.6MB

                                                                                                • memory/1064-641-0x0000000000D00000-0x0000000000E9C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.6MB

                                                                                                • memory/1064-640-0x0000000000D00000-0x0000000000E9C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.6MB

                                                                                                • memory/1368-803-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-918-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-639-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-934-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-933-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-932-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-929-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-927-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-926-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-925-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-924-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-923-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-922-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-869-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-921-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-920-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-919-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-794-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-894-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-895-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-896-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-897-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-898-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-900-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-901-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-902-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-903-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-904-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-905-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-906-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-907-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-908-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-909-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-910-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-911-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-912-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-913-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-915-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-916-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/1368-917-0x0000000000CF0000-0x000000000132D000-memory.dmp
                                                                                                  Filesize

                                                                                                  6.2MB

                                                                                                • memory/2088-647-0x0000000000B00000-0x0000000000BF4000-memory.dmp
                                                                                                  Filesize

                                                                                                  976KB

                                                                                                • memory/2088-650-0x0000000000B00000-0x0000000000BF4000-memory.dmp
                                                                                                  Filesize

                                                                                                  976KB

                                                                                                • memory/2088-651-0x0000000000B00000-0x0000000000BF4000-memory.dmp
                                                                                                  Filesize

                                                                                                  976KB

                                                                                                • memory/2844-871-0x0000000000D40000-0x0000000000E4C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/2844-872-0x0000000000D40000-0x0000000000E4C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/2844-870-0x0000000000D40000-0x0000000000E4C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/2872-791-0x0000000001360000-0x000000000146C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/2872-792-0x0000000001360000-0x000000000146C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/2872-793-0x0000000001360000-0x000000000146C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/5228-801-0x0000000000420000-0x000000000052C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/5228-802-0x0000000000420000-0x000000000052C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/5228-800-0x0000000000420000-0x000000000052C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/5320-653-0x0000000001340000-0x000000000144C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/5320-654-0x0000000001340000-0x000000000144C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB

                                                                                                • memory/5320-652-0x0000000001340000-0x000000000144C000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.0MB