Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 17:10

General

  • Target

    neoblock level 7.exe

  • Size

    59.9MB

  • MD5

    6ae2207c47e70031568cf97e395834a5

  • SHA1

    e4af50fa66d8557add94177c9052dc65695f8ac6

  • SHA256

    da0602bb021ceeaeae97ed4268ee25dec1f9edbc482ae72e6768063e5f452226

  • SHA512

    e82a605aa15d8894c32e01ba62e8e16e2d57d5dd4e911d9ac12a1978ed84c6c5cb7ad1c5f542fb2282c4edb11c35154d89b81c6961dee520e36c7d7518ec33a6

  • SSDEEP

    786432:C03HGn5Qgx0GWFZ/rVr1NHG6YCo+qiquJqRet3Potrdh7BlBtOzh:7H4x0GwNrlHG6YCoZSzoAd

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

  • Creates new service(s) 2 TTPs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 17 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:380
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:680
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:964
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:872
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:908
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1040
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1136
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:2588
                    • C:\Program Files\Google\Chrome\updater.exe
                      "C:\Program Files\Google\Chrome\updater.exe"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Program Files directory
                      PID:4280
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1144
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Drops file in System32 directory
                      PID:1188
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1260
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                        1⤵
                          PID:1336
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1368
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                            1⤵
                              PID:1420
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                              1⤵
                                PID:1436
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1512
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1528
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                      • Modifies registry class
                                      PID:2448
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1660
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1704
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1736
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1808
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1816
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1900
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1912
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1984
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1992
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:1716
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2200
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2212
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2224
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                            1⤵
                                                              PID:2464
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                              1⤵
                                                                PID:2552
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2560
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                    PID:2612
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                    1⤵
                                                                    • Enumerates connected drives
                                                                    PID:2688
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                    1⤵
                                                                      PID:2728
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:2736
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2772
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2792
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:2800
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                            1⤵
                                                                              PID:3516
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:3532
                                                                              • C:\Users\Admin\AppData\Local\Temp\neoblock level 7.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\neoblock level 7.exe"
                                                                                2⤵
                                                                                • Checks computer location settings
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1844
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAeQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAYQBpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAawBkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAdQBwACMAPgA="
                                                                                  3⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3180
                                                                                • C:\Users\Admin\AppData\Local\Temp\Neoblock's Level 7.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Neoblock's Level 7.exe"
                                                                                  3⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2716
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAcwBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAawBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAaABpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAZgB1ACMAPgA="
                                                                                    4⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4932
                                                                                  • C:\Users\Admin\AppData\Local\Temp\neobloxBootstrapper.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\neobloxBootstrapper.exe"
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3592
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      5⤵
                                                                                        PID:440
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/NeobloxExecutor/neoblox/issues
                                                                                        5⤵
                                                                                        • Enumerates system info in registry
                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                        PID:1172
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe147f46f8,0x7ffe147f4708,0x7ffe147f4718
                                                                                          6⤵
                                                                                            PID:2196
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
                                                                                            6⤵
                                                                                              PID:1236
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
                                                                                              6⤵
                                                                                                PID:1104
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
                                                                                                6⤵
                                                                                                  PID:1184
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                                                                                  6⤵
                                                                                                    PID:4280
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                                                                                                    6⤵
                                                                                                      PID:4804
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
                                                                                                      6⤵
                                                                                                        PID:1296
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                                                                        6⤵
                                                                                                          PID:4984
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4068 /prefetch:8
                                                                                                          6⤵
                                                                                                            PID:4668
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4068 /prefetch:8
                                                                                                            6⤵
                                                                                                              PID:1100
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
                                                                                                              6⤵
                                                                                                                PID:5128
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
                                                                                                                6⤵
                                                                                                                  PID:5812
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
                                                                                                                  6⤵
                                                                                                                    PID:5820
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
                                                                                                                    6⤵
                                                                                                                      PID:6084
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17605222019405833699,16168222149385127791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
                                                                                                                      6⤵
                                                                                                                        PID:812
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Roblox.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Roblox.exe"
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2520
                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                      5⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:5076
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                      5⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3096
                                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                        6⤵
                                                                                                                          PID:3320
                                                                                                                      • C:\Windows\system32\dialer.exe
                                                                                                                        C:\Windows\system32\dialer.exe
                                                                                                                        5⤵
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4292
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        C:\Windows\system32\sc.exe delete "HGJYCZBA"
                                                                                                                        5⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:3728
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        C:\Windows\system32\sc.exe create "HGJYCZBA" binpath= "C:\ProgramData\zpjeqqssntxg\ndfstabgdmbm.exe" start= "auto"
                                                                                                                        5⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:4024
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        C:\Windows\system32\sc.exe stop eventlog
                                                                                                                        5⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:4624
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        C:\Windows\system32\sc.exe start "HGJYCZBA"
                                                                                                                        5⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:4820
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          6⤵
                                                                                                                            PID:3020
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ccccc.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ccccc.exe"
                                                                                                                      3⤵
                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:3676
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                    2⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1612
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:2296
                                                                                                                    • C:\Windows\System32\dialer.exe
                                                                                                                      C:\Windows\System32\dialer.exe
                                                                                                                      2⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2056
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gnbixakp#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                                                                                                                      2⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2492
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        3⤵
                                                                                                                          PID:1852
                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                                                                                                                        2⤵
                                                                                                                          PID:3184
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            3⤵
                                                                                                                              PID:4112
                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                            2⤵
                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                            PID:1924
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                            2⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:2168
                                                                                                                          • C:\Windows\System32\dialer.exe
                                                                                                                            C:\Windows\System32\dialer.exe
                                                                                                                            2⤵
                                                                                                                              PID:4624
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gnbixakp#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                                                                                                                              2⤵
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              PID:3168
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                3⤵
                                                                                                                                  PID:4860
                                                                                                                              • C:\Windows\System32\dialer.exe
                                                                                                                                C:\Windows\System32\dialer.exe
                                                                                                                                2⤵
                                                                                                                                  PID:3524
                                                                                                                                • C:\Windows\System32\dialer.exe
                                                                                                                                  C:\Windows\System32\dialer.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:3500
                                                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                    2⤵
                                                                                                                                      PID:4632
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                    1⤵
                                                                                                                                      PID:3716
                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                      1⤵
                                                                                                                                        PID:3900
                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:4060
                                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                          1⤵
                                                                                                                                            PID:4180
                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:4544
                                                                                                                                            • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                              C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                              1⤵
                                                                                                                                                PID:2948
                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                1⤵
                                                                                                                                                  PID:3776
                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4648
                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2108
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:4784
                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:2268
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4220
                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3324
                                                                                                                                                        • C:\ProgramData\zpjeqqssntxg\ndfstabgdmbm.exe
                                                                                                                                                          C:\ProgramData\zpjeqqssntxg\ndfstabgdmbm.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:4252
                                                                                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                            2⤵
                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3076
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1600
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1952
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4940
                                                                                                                                                                  • C:\Windows\system32\wusa.exe
                                                                                                                                                                    wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4876
                                                                                                                                                                  • C:\Windows\system32\dialer.exe
                                                                                                                                                                    C:\Windows\system32\dialer.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:5024
                                                                                                                                                                  • C:\Windows\system32\dialer.exe
                                                                                                                                                                    C:\Windows\system32\dialer.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2648
                                                                                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                                                                                      dialer.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:2220
                                                                                                                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    PID:4988
                                                                                                                                                                  • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                    C:\Windows\System32\WaaSMedicAgent.exe a333d98519b2debbfd7a048f698a0bad dTX2JRjEiUGiIukDITRm1A.0.1.0.0.0
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Sets service image path in registry
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    PID:1576
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1296
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:5052
                                                                                                                                                                    • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                      C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1284
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4108
                                                                                                                                                                        • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                          C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          PID:3952
                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4444
                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3488
                                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3840
                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:436
                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3736
                                                                                                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                    PID:5376
                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5512
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                      PID:5556
                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5648
                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k netsvcs
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5972

                                                                                                                                                                                        Network

                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                        Downloads

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          152B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          612a6c4247ef652299b376221c984213

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          d306f3b16bde39708aa862aee372345feb559750

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          152B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          56641592f6e69f5f5fb06f2319384490

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          6a86be42e2c6d26b7830ad9f4e2627995fd91069

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          3c0eecaef42dd80b2a1ac2a0c7760cb9

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          37ec0828a05108b6bd40dd32c460196ebd23f565

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          4eb88c0ea33d3e2b24fff2ac2be4d9017f9c48999a58b39f3b9f61bf1d58d3d5

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          cf6dc0f9603fbd897a178d9505e551a4e2da854e96815d6d9ea1dd12fd72769a9ee9c33b1176c12a7bbb5aa5a7ddbbbaf50f181c297bbd02789d902530248a88

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          78baca28e8b9a51bc008094503a10f72

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4b9b8ffb3290f35d54f5e0643fddbadcb2db5bf0

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          92a3989f6b6d9b3e1440795575e62c2fe7abd39e5698d21b861383b9597b9fd6

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          0e7875544bab6fcfa06c4e224b15ee88cb5704b119b5bb52f6130f5f896fca667cb9db0949716af90e2db0d46fa0fbb87a2629245000129c07df8ea49a10a115

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          3022ee6e9899b1e10c666fc29888a4b7

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          5765c213e13d4a7bd74ac6de10b3064d004c0d37

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          a6a1e3f4ae60cb7b35046da51440e536adf140f54311932dada4d0b291f48771

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c0f314f206fb89322ac82b8c120aff12a801943af92bed0c0959c44213f91bcef11c6534b1c6ac45d9a99c4daa2342a953e499da7764880923e43d332ff69917

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          16B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          46295cac801e5d4857d09837238a6394

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          16B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          206702161f94c5cd39fadd03f4014d98

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          8KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          16991097a0e739c1548dc624504682b8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          8b4e4aae5a405dc7516a4ca759fde17beaf1c6ec

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          83e76bd507275fbe115790cedd66959059d19877c3dd062b2bc76ff98875b51a

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          a324c92f56bae16adacacb1b157492dae74ffbb48287cdb6205a2a1ea02d25c290932bcc32d1ebdf796f10495f6a32fe5bc217b02ad99049d71b5dc0a92c05fe

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          8KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ccc886b8747ea9a46c8e86f3abad939b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          7797ea59f26a7029965b8b3eb95321f36881e3a2

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          518667c22b8026c85cbc8be2f1343f176e39a7844373cb8e00bd262588da7bf2

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          330fd9e3e66f04b368acc989b60a84fd6d2a0b0df3a86fa1105819af9f7f0602a346682ac525489f3aa961d6ea12a9c72783d91f7bc67f05ed7672c7f997242c

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          18KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          84f3d6737d8a51094ecc2ddfce71566c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          543e939a005e3bc30b1fe9fcc7cdb65d187e5ddf

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          fd5766867107618281168d2d2f46a8cbbe97b24a07db53d636880d16148a31ab

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          4cbd4da1a75adddf04d586f22f4ef21988d7a69c46ac390d53e693adf46349eef7c2f71c713bc6ff198dfecc4e6814482425dd8932300c033a5fa49bd2858331

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          944B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          9b80cd7a712469a4c45fec564313d9eb

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          6125c01bc10d204ca36ad1110afe714678655f2d

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          944B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          60945d1a2e48da37d4ce8d9c56b6845a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          83e80a6acbeb44b68b0da00b139471f428a9d6c1

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Neoblock's Level 7.exe

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          3.2MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fa532255379e9d0135b519e96b62f6ca

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          099c0338db1a0aedf4e050ad0be7380034cf149e

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          3335ee3c5d3f45de09712165a407755a051e5a2c812fa2a87d81431b5b3c583a

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          fd2176004c7235bf215c2c62064559c023e47aa5def987c8344765d5f67a1dfb74e0bfb0ecd044bb1be247b3db4204a8c8bd2cbe622ba99bd81f0a6921c2bd4e

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Roblox.exe

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.8MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fa9383ead577a1004af69c84708d66e0

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          db0472630e63ae1819fdadbef7def6bbeb0c485e

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          e8e0c6615894c8eecdb536ea891f042ca35e44afac88beddb9e9a4c79bb3c293

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6f67a6e52910c578e8ec953bfc1fb17d49b7fc1bc0337a5e3fe41e4572f0e2bdeaeb45b2be44ceda471ba64e8381cd08bdca1faec7dc2cdc67c6534e007ffd92

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vnvnfopo.w3z.ps1

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          60B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\neobloxBootstrapper.exe

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          323KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          07c00a89b882adab59d0b2e6eeac3516

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          05ef4e1c48a3d081bb535b979e0e88a242cfdd48

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          719f686324040140c4d8b03c5a35c4036b2a5535f1ee5aaf50ad79f2367126e2

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6a98ce5df9a7fbeb910bbea419b22794b7b4cde06f19222e55c1a21642a1e7b0036ae95022006de7ce8eabca78773ec07b01ee6e9d6ef6a6d7b62aebf5e15401

                                                                                                                                                                                        • C:\Windows\INF\netrasa.PNF

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          22KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          43019890670b0698a45ad8bfb9308c10

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          e0fa23babc570ddee4cc363b6f92c7731bea7240

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593c3160fb07807dd4d445bbc6c51780d1d95afba9aae4f37dca1edc1186819

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6fa79855919999aa035ebfa5171cd2df20403c00a0f70882fd38556dfbd5f07725f48fc2f5c6b9bd1fec43651bb681010091b765d0851b484ad8ba58a60b29f9

                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          f313c5b4f95605026428425586317353

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          bdb25c22d14ec917e30faf353826c5de

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                                                                                                                                                                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          b42c70c1dbf0d1d477ec86902db9e986

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                                                                                                                                                                                        • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          877cbe19207b431000ab1f991bf8ca46

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          16fefd70e50230c0a26cbb00cad1016ea7745d6c

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          9d70a7dc15e248b27d6bf474b86ac4ec094cc2f0d043dd125036bc2d319d4c50

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          91e6a97a69cbc727d7a97abc2abe44df32d0bfb509ceecabd9fbfd0208dbd659248e05f11abed60caeb84d6f12307255379be2a4db613703e2067044724a13fa

                                                                                                                                                                                        • \??\pipe\LOCAL\crashpad_1172_KZSCLFIUZNIQDWGK

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                        • memory/380-141-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/380-140-0x0000025037690000-0x00000250376BB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/612-130-0x0000028162EB0000-0x0000028162ED4000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          144KB

                                                                                                                                                                                        • memory/612-131-0x0000028162EE0000-0x0000028162F0B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/612-132-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/680-135-0x0000010F66E50000-0x0000010F66E7B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/680-136-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/872-147-0x000002B1442D0000-0x000002B1442FB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/872-148-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/908-156-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/908-155-0x000001F431AF0000-0x000001F431B1B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/964-143-0x000001C0A1F10000-0x000001C0A1F3B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/964-144-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/1040-158-0x000001C2CD4E0000-0x000001C2CD50B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/1040-159-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/1136-161-0x00000281EEA60000-0x00000281EEA8B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/1136-162-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/1144-165-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/1144-164-0x000001D7F7CC0000-0x000001D7F7CEB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/1188-168-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/1188-167-0x000001CCAB290000-0x000001CCAB2BB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/1260-172-0x000001B0B0B70000-0x000001B0B0B9B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/1260-173-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/1336-175-0x000002E7FE960000-0x000002E7FE98B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/1336-176-0x00007FFDF2FF0000-0x00007FFDF3000000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                        • memory/3076-445-0x000002197F280000-0x000002197F29A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          104KB

                                                                                                                                                                                        • memory/3076-415-0x000002197EFF0000-0x000002197F00C000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          112KB

                                                                                                                                                                                        • memory/3076-448-0x000002197F270000-0x000002197F27A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          40KB

                                                                                                                                                                                        • memory/3076-447-0x000002197F260000-0x000002197F266000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          24KB

                                                                                                                                                                                        • memory/3076-446-0x000002197F230000-0x000002197F238000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          32KB

                                                                                                                                                                                        • memory/3076-444-0x000002197F220000-0x000002197F22A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          40KB

                                                                                                                                                                                        • memory/3076-425-0x000002197F240000-0x000002197F25C000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          112KB

                                                                                                                                                                                        • memory/3076-417-0x000002197F0D0000-0x000002197F0DA000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          40KB

                                                                                                                                                                                        • memory/3076-416-0x000002197F010000-0x000002197F0C5000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          724KB

                                                                                                                                                                                        • memory/3180-99-0x0000000007820000-0x0000000007828000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          32KB

                                                                                                                                                                                        • memory/3180-96-0x00000000077E0000-0x00000000077EE000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          56KB

                                                                                                                                                                                        • memory/3180-11-0x0000000002CA0000-0x0000000002CD6000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          216KB

                                                                                                                                                                                        • memory/3180-23-0x0000000005390000-0x00000000059B8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.2MB

                                                                                                                                                                                        • memory/3180-68-0x0000000007420000-0x0000000007452000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          200KB

                                                                                                                                                                                        • memory/3180-69-0x0000000070950000-0x000000007099C000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          304KB

                                                                                                                                                                                        • memory/3180-64-0x0000000006270000-0x000000000628E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          120KB

                                                                                                                                                                                        • memory/3180-39-0x0000000005C50000-0x0000000005CB6000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          408KB

                                                                                                                                                                                        • memory/3180-38-0x0000000005B30000-0x0000000005B96000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          408KB

                                                                                                                                                                                        • memory/3180-37-0x00000000052B0000-0x00000000052D2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          136KB

                                                                                                                                                                                        • memory/3180-93-0x0000000007610000-0x000000000761A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          40KB

                                                                                                                                                                                        • memory/3180-51-0x0000000005CC0000-0x0000000006014000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          3.3MB

                                                                                                                                                                                        • memory/3180-65-0x0000000006570000-0x00000000065BC000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          304KB

                                                                                                                                                                                        • memory/3592-35-0x0000000000DA0000-0x0000000000DF6000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          344KB

                                                                                                                                                                                        • memory/3592-36-0x0000000001670000-0x000000000167A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          40KB

                                                                                                                                                                                        • memory/3676-102-0x00007FF6A6070000-0x00007FF6A9923000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          56.7MB

                                                                                                                                                                                        • memory/4292-122-0x00007FFE32F70000-0x00007FFE33165000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.0MB

                                                                                                                                                                                        • memory/4292-118-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/4292-116-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/4292-119-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/4292-127-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/4292-123-0x00007FFE32890000-0x00007FFE3294E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          760KB

                                                                                                                                                                                        • memory/4292-121-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/4292-117-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          172KB

                                                                                                                                                                                        • memory/4932-95-0x0000000007280000-0x0000000007291000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          68KB

                                                                                                                                                                                        • memory/4932-70-0x0000000070950000-0x000000007099C000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          304KB

                                                                                                                                                                                        • memory/4932-94-0x0000000007310000-0x00000000073A6000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          600KB

                                                                                                                                                                                        • memory/4932-89-0x0000000006370000-0x000000000638E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          120KB

                                                                                                                                                                                        • memory/4932-97-0x00000000073F0000-0x0000000007404000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          80KB

                                                                                                                                                                                        • memory/4932-91-0x00000000076D0000-0x0000000007D4A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.5MB

                                                                                                                                                                                        • memory/4932-90-0x0000000006F60000-0x0000000007003000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          652KB

                                                                                                                                                                                        • memory/4932-98-0x0000000007430000-0x000000000744A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          104KB

                                                                                                                                                                                        • memory/4932-92-0x0000000007080000-0x000000000709A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          104KB

                                                                                                                                                                                        • memory/5076-108-0x0000025ACF960000-0x0000025ACF982000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          136KB