Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    257s
  • max time network
    275s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 23:20

General

  • Target

    https://github.com/IHaxU/Wave-Goodbye/raw/main/Wave%20Goodbye.exe

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 40 IoCs
  • Themida packer 31 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks for any installed AV software in registry 1 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/IHaxU/Wave-Goodbye/raw/main/Wave%20Goodbye.exe
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b7446f8,0x7ff82b744708,0x7ff82b744718
      2⤵
        PID:1140
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:2000
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1152
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
          2⤵
            PID:776
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
            2⤵
              PID:3992
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
              2⤵
                PID:4204
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
                2⤵
                  PID:2948
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4944
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4188 /prefetch:8
                  2⤵
                    PID:3324
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                    2⤵
                      PID:4600
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6048 /prefetch:8
                      2⤵
                        PID:4000
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:380
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
                        2⤵
                          PID:4116
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
                          2⤵
                            PID:4000
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
                            2⤵
                              PID:2388
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                              2⤵
                                PID:2612
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:1
                                2⤵
                                  PID:380
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
                                  2⤵
                                    PID:4188
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 /prefetch:8
                                    2⤵
                                      PID:1348
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,13243871944423666922,11342458054005772070,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5808 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3144
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1012
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:832
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                        1⤵
                                          PID:1212
                                        • C:\Users\Admin\Downloads\Wave Goodbye.exe
                                          "C:\Users\Admin\Downloads\Wave Goodbye.exe"
                                          1⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Drops file in Drivers directory
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Modifies system certificate store
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4440
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/6NNYUEXAR2
                                            2⤵
                                              PID:4852
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff82b7446f8,0x7ff82b744708,0x7ff82b744718
                                                3⤵
                                                  PID:1012
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                              1⤵
                                              • Enumerates system info in registry
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:5308
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff82aadab58,0x7ff82aadab68,0x7ff82aadab78
                                                2⤵
                                                  PID:5324
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:2
                                                  2⤵
                                                    PID:5372
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                    2⤵
                                                      PID:5156
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                      2⤵
                                                        PID:2904
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:1
                                                        2⤵
                                                          PID:1680
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:1
                                                          2⤵
                                                            PID:5428
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:1
                                                            2⤵
                                                              PID:5688
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                              2⤵
                                                                PID:1156
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4372 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                2⤵
                                                                  PID:2868
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                  2⤵
                                                                    PID:5776
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4904 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:5900
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                      2⤵
                                                                        PID:3788
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4800 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:1
                                                                        2⤵
                                                                          PID:1124
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5108 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:1
                                                                          2⤵
                                                                            PID:5140
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:5744
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5136 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                              2⤵
                                                                                PID:4108
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5144 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                                2⤵
                                                                                  PID:5760
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                                  2⤵
                                                                                    PID:1412
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4328 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                                    2⤵
                                                                                      PID:2964
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5196 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                                      2⤵
                                                                                        PID:1468
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3284 --field-trial-handle=1820,i,12379753350750988667,3928587079245974857,131072 /prefetch:8
                                                                                        2⤵
                                                                                          PID:3612
                                                                                        • C:\Users\Admin\Downloads\WaveInstaller.exe
                                                                                          "C:\Users\Admin\Downloads\WaveInstaller.exe"
                                                                                          2⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5584
                                                                                          • C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe
                                                                                            "C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe"
                                                                                            3⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5420
                                                                                            • C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe
                                                                                              "C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe"
                                                                                              4⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Checks for any installed AV software in registry
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:5144
                                                                                              • C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
                                                                                                "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,2874947295252554250,10127910460847000049,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2072 --mojo-platform-channel-handle=2040 /prefetch:2 --host-process-id=5144
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1716
                                                                                              • C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
                                                                                                "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --field-trial-handle=2712,i,2874947295252554250,10127910460847000049,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=2716 --mojo-platform-channel-handle=2660 /prefetch:3 --host-process-id=5144
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4324
                                                                                              • C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
                                                                                                "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=5144
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5752
                                                                                                • C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave-luau.exe" lsp "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\globalTypes.d.luau" "--definitions=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\wave.d.luau" "--docs=C:\Users\Admin\AppData\Local\Luau Language Server\shared\bin\en-us.json"
                                                                                                  6⤵
                                                                                                    PID:5224
                                                                                                • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
                                                                                                  5⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  PID:2312
                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe" /silent /install
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:6180
                                                                                                    • C:\Program Files (x86)\Microsoft\Temp\EU2A39.tmp\MicrosoftEdgeUpdate.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Temp\EU2A39.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                                                                      7⤵
                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Checks system information in the registry
                                                                                                      • Drops file in Program Files directory
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:6564
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                                                        8⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Modifies registry class
                                                                                                        PID:6464
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                                                        8⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Modifies registry class
                                                                                                        PID:6604
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                          9⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:6612
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                          9⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:6668
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                                          9⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:6776
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUM3MkFCMDktRjU2OC00RTBGLTg3NEMtRDZCRTFDM0E5QTIxfSIgdXNlcmlkPSJ7M0REMDREOTMtOUJCNi00RkY3LTlEQzYtNkYyM0Q0OUNDMUQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2OUU3MDkzMS0wNzM4LTRBMzYtQUVFNy1CNDM5RjE0QzA3MTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny40MSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMjEzMTg5NDgiIGluc3RhbGxfdGltZV9tcz0iNzEyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                        8⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Checks system information in the registry
                                                                                                        PID:6708
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{1C72AB09-F568-4E0F-874C-D6BE1C3A9A21}" /silent
                                                                                                        8⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        PID:6784
                                                                                                • C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
                                                                                                  "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --field-trial-handle=6264,i,2874947295252554250,10127910460847000049,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=6268 --mojo-platform-channel-handle=6332 /prefetch:8 --host-process-id=5144
                                                                                                  5⤵
                                                                                                    PID:7900
                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
                                                                                                    "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=6400,i,2874947295252554250,10127910460847000049,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=6396 --mojo-platform-channel-handle=6388 --host-process-id=5144 /prefetch:1
                                                                                                    5⤵
                                                                                                      PID:7892
                                                                                                    • C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe
                                                                                                      "C:\Users\Admin\AppData\Local\CefSharp\CefSharp.BrowserSubprocess.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\CefSharp\locales" --resources-dir-path="C:\Users\Admin\AppData\Local\CefSharp" --user-data-dir="C:\Users\Admin\AppData\Local\CefSharp" --cefsharpexitsub --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=6436,i,2874947295252554250,10127910460847000049,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --enable-logging=handle --log-file=6448 --mojo-platform-channel-handle=6428 --host-process-id=5144 /prefetch:1
                                                                                                      5⤵
                                                                                                        PID:7932
                                                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:5676
                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                                  1⤵
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  • Checks processor information in registry
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  PID:6044
                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Checks system information in the registry
                                                                                                  PID:6840
                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUM3MkFCMDktRjU2OC00RTBGLTg3NEMtRDZCRTFDM0E5QTIxfSIgdXNlcmlkPSJ7M0REMDREOTMtOUJCNi00RkY3LTlEQzYtNkYyM0Q0OUNDMUQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswN0QwRUUyMS0wRENDLTQ4M0ItQTkwOC0wRUIwNjZDRjg2MjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxMjcxMzg3ODMiLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Checks system information in the registry
                                                                                                    PID:7188
                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x2ec 0x4f0
                                                                                                  1⤵
                                                                                                    PID:7852

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

                                                                                                    Filesize

                                                                                                    201KB

                                                                                                    MD5

                                                                                                    4dc57ab56e37cd05e81f0d8aaafc5179

                                                                                                    SHA1

                                                                                                    494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                                                                    SHA256

                                                                                                    87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                                                                    SHA512

                                                                                                    320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                                                                  • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                                                                    Filesize

                                                                                                    196KB

                                                                                                    MD5

                                                                                                    d110423e0c47430d584b1bbfe7a3b831

                                                                                                    SHA1

                                                                                                    16bb5b324ecd712f5f83d44e0632554218cc0738

                                                                                                    SHA256

                                                                                                    26826b628c412982ce820ab430bc1d6e7d0f5d5b6b4f856e11988ce631d01b10

                                                                                                    SHA512

                                                                                                    c22c306be98ae4f1f2f11ae2955ba5c0ea36e10f10c23442df9b1905089df7cf8d72cbbdee57db222c96522b57f9672ae00df420d797b04ac7fcbd3208aa02a2

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe

                                                                                                    Filesize

                                                                                                    249KB

                                                                                                    MD5

                                                                                                    772c9fecbd0397f6cfb3d866cf3a5d7d

                                                                                                    SHA1

                                                                                                    6de3355d866d0627a756d0d4e29318e67650dacf

                                                                                                    SHA256

                                                                                                    2f88ea7e1183d320fb2b7483de2e860da13dc0c0caaf58f41a888528d78c809f

                                                                                                    SHA512

                                                                                                    82048bd6e50d38a863379a623b8cfda2d1553d8141923acf13f990c7245c833082523633eaa830362a12bfff300da61b3d8b3cccbe038ce2375fdfbd20dbca31

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png

                                                                                                    Filesize

                                                                                                    20KB

                                                                                                    MD5

                                                                                                    4f8f43c5d5c2895640ed4fdca39737d5

                                                                                                    SHA1

                                                                                                    fb46095bdfcab74d61e1171632c25f783ef495fa

                                                                                                    SHA256

                                                                                                    fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1

                                                                                                    SHA512

                                                                                                    7aebc0f79b2b23a76fb41df8bab4411813ffb1abc5e2797810679c0eaa690e7af7561b8473405694bd967470be337417fa42e30f0318acbf171d8f31620a31aa

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaApp\graphic\[email protected]

                                                                                                    Filesize

                                                                                                    71KB

                                                                                                    MD5

                                                                                                    3fec0191b36b9d9448a73ff1a937a1f7

                                                                                                    SHA1

                                                                                                    bee7d28204245e3088689ac08da18b43eae531ba

                                                                                                    SHA256

                                                                                                    1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89

                                                                                                    SHA512

                                                                                                    a8ab2bc2d937963af36d3255c6ea09cae6ab1599996450004bb18e8b8bdfbdde728821ac1662d8a0466680679011d8f366577b143766838fe91edf08a40353ce

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png

                                                                                                    Filesize

                                                                                                    247B

                                                                                                    MD5

                                                                                                    81ce54dfd6605840a1bd2f9b0b3f807d

                                                                                                    SHA1

                                                                                                    4a3a4c05b9c14c305a8bb06c768abc4958ba2f1c

                                                                                                    SHA256

                                                                                                    0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386

                                                                                                    SHA512

                                                                                                    57069c8ac03dd0fdfd97e2844c19138800ff6f7d508c26e5bc400b30fe78baa0991cc39f0f86fa10cd5d12b6b11b0b09c1a770e5cb2fdca157c2c8986a09e5ff

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\configs\DateTimeLocaleConfigs\zh-hans.json

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    fb6605abd624d1923aef5f2122b5ae58

                                                                                                    SHA1

                                                                                                    6e98c0a31fa39c781df33628b55568e095be7d71

                                                                                                    SHA256

                                                                                                    7b993133d329c46c0c437d985eead54432944d7b46db6ad6ea755505b8629d00

                                                                                                    SHA512

                                                                                                    97a14eda2010033265b379aa5553359293baf4988a4cdde8a40b0315e318a7b30feee7f5e14c68131e85610c00585d0c67e636999e3af9b5b2209e1a27a82223

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\configs\DateTimeLocaleConfigs\zh-tw.json

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    702c9879f2289959ceaa91d3045f28aa

                                                                                                    SHA1

                                                                                                    775072f139acc8eafb219af355f60b2f57094276

                                                                                                    SHA256

                                                                                                    a92a6988175f9c1d073e4b54bf6a31f9b5d3652eebdf6a351fb5e12bda76cbd5

                                                                                                    SHA512

                                                                                                    815a6bef134c0db7a5926f0cf4b3f7702d71b0b2f13eca9539cd2fc5a61eea81b1884e4c4bc0b3398880589bff809ac8d5df833e7e4aeda4a1244e9a875d1e97

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\Cursors\KeyboardMouse\IBeamCursor.png

                                                                                                    Filesize

                                                                                                    292B

                                                                                                    MD5

                                                                                                    464c4983fa06ad6cf235ec6793de5f83

                                                                                                    SHA1

                                                                                                    8afeb666c8aee7290ab587a2bfb29fc3551669e8

                                                                                                    SHA256

                                                                                                    99fd7f104948c6ab002d1ec69ffd6c896c91f9accc499588df0980b4346ecbed

                                                                                                    SHA512

                                                                                                    f805f5f38535fe487b899486c8de6cf630114964e2c3ebc2af7152a82c6f6faef681b4d936a1867b5dff6566b688b5c01105074443cc2086b3fe71f7e6e404b1

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\StudioToolbox\Clear.png

                                                                                                    Filesize

                                                                                                    538B

                                                                                                    MD5

                                                                                                    fa8eaf9266c707e151bb20281b3c0988

                                                                                                    SHA1

                                                                                                    3ca097ad4cd097745d33d386cc2d626ece8cb969

                                                                                                    SHA256

                                                                                                    8cf08bf7e50fea7b38f59f162ed956346c55a714ed8a9a8b0a1ada7e18480bc2

                                                                                                    SHA512

                                                                                                    e29274300eab297c6de895bb39170f73f0a4ffa2a8c3732caeeeac16e2c25fb58bb401fdd5823cc62d9c413ec6c43d7c46861d7e14d52f8d9d8ff632e29f167c

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png

                                                                                                    Filesize

                                                                                                    130B

                                                                                                    MD5

                                                                                                    521fb651c83453bf42d7432896040e5e

                                                                                                    SHA1

                                                                                                    8fdbf2cc2617b5b58aaa91b94b0bf755d951cad9

                                                                                                    SHA256

                                                                                                    630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70

                                                                                                    SHA512

                                                                                                    8fa0a50e52a3c7c53735c7dd7af275ebc9c1843f55bb30ebe0587a85955a8da94ff993822d233f7ed118b1070a7d67718b55ba4a597dc49ed2bf2a3836c696f6

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\TerrainTools\checkbox_square.png

                                                                                                    Filesize

                                                                                                    985B

                                                                                                    MD5

                                                                                                    2cb16991a26dc803f43963bdc7571e3f

                                                                                                    SHA1

                                                                                                    12ad66a51b60eeaed199bc521800f7c763a3bc7b

                                                                                                    SHA256

                                                                                                    c7bae6d856f3bd9f00c122522eb3534d0d198a9473b6a379a5c3458181870646

                                                                                                    SHA512

                                                                                                    4c9467e5e2d83b778d0fb8b6fd97964f8d8126f07bfd50c5d68c256703f291ceaed56be057e8e2c591b2d2c49f6b7e099a2b7088d0bf5bdd901433459663b1f8

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\Thumbstick1.png

                                                                                                    Filesize

                                                                                                    641B

                                                                                                    MD5

                                                                                                    2cbe38df9a03133ddf11a940c09b49cd

                                                                                                    SHA1

                                                                                                    6fb5c191ed8ce9495c66b90aaf53662bfe199846

                                                                                                    SHA256

                                                                                                    0835a661199a7d8df7249e8ae925987184efcc4fb85d9efac3cc2c1495020517

                                                                                                    SHA512

                                                                                                    dcef5baccef9fff632456fe7bc3c4f4a403363d9103a8047a55f4bd4c413d0c5f751a2e37385fe9eba7a420dbdb77ca2ff883d47fcdd35af222191cc5bd5c7a9

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    e8c88cf5c5ef7ae5ddee2d0e8376b32f

                                                                                                    SHA1

                                                                                                    77f2a5b11436d247d1acc3bac8edffc99c496839

                                                                                                    SHA256

                                                                                                    9607af14604a8e8eb1dec45d3eeca01fed33140c0ccc3e6ef8ca4a1f6219b5dd

                                                                                                    SHA512

                                                                                                    32f5a1e907705346a56fbddfe0d8841d05415ff7abe28ae9281ba46fedf8270b982be0090b72e2e32de0ce36e21934f80eaf508fd010f7ab132d39f5305fb68f

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    499333dae156bb4c9e9309a4842be4c8

                                                                                                    SHA1

                                                                                                    d18c4c36bdb297208589dc93715560acaf761c3a

                                                                                                    SHA256

                                                                                                    d35a74469f1436f114c27c730a5ec0793073bcf098db37f10158d562a3174591

                                                                                                    SHA512

                                                                                                    91c64173d2cdabc045c70e0538d45e1022cc74ec04989565b85f0f26fe3e788b700a0956a07a8c91d34c06fc1b7fad43bbdbb41b0c6f15b9881c3e46def8103e

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\Thumbstick2.png

                                                                                                    Filesize

                                                                                                    738B

                                                                                                    MD5

                                                                                                    a402aacac8be906bcc07d50669d32061

                                                                                                    SHA1

                                                                                                    9d75c1afbe9fc482983978cae4c553aa32625640

                                                                                                    SHA256

                                                                                                    62a313b6cc9ffe7dd86bc9c4fcd7b8e8d1f14a15cdf41a53fb69af4ae3416102

                                                                                                    SHA512

                                                                                                    d11567bcaad8bbd9e2b9f497c3215102c7e7546caf425e93791502d3d2b3f78dec13609796fcd6e1e7f5c7d794bac074d00a74001e7fe943d63463b483877546

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    83e9b7823c0a5c4c67a603a734233dec

                                                                                                    SHA1

                                                                                                    2eaf04ad636bf71afdf73b004d17d366ac6d333e

                                                                                                    SHA256

                                                                                                    3b5e06eb1a89975def847101f700f0caa60fe0198f53e51974ef1608c6e1e067

                                                                                                    SHA512

                                                                                                    e8abb39a1ec340ac5c7d63137f607cd09eae0e885e4f73b84d8adad1b8f574155b92fbf2c9d3013f64ebbb6d55ead5419e7546b0f70dcde976d49e7440743b0f

                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\content\textures\ui\Controls\XboxController\[email protected]

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    55b64987636b9740ab1de7debd1f0b2f

                                                                                                    SHA1

                                                                                                    96f67222ce7d7748ec968e95a2f6495860f9d9c9

                                                                                                    SHA256

                                                                                                    f4a6bb3347ee3e603ea0b2f009bfa802103bc434ae3ff1db1f2043fa8cace8fc

                                                                                                    SHA512

                                                                                                    73a88a278747de3fefbaabb3ff90c1c0750c8d6c17746787f17061f4eff933620407336bf9b755f4222b0943b07d8c4d01de1815d42ea65e78e0daa7072591e9

                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\LocalPrefs.json

                                                                                                    Filesize

                                                                                                    738B

                                                                                                    MD5

                                                                                                    28b7e19429bfecc39a2328c699d60615

                                                                                                    SHA1

                                                                                                    b685feca0ae538aa581d30474cf786221285a986

                                                                                                    SHA256

                                                                                                    1e91738838c90acf95c64d3d530e1f3c64866f2e00936cb1e6eb4b6e463c5a28

                                                                                                    SHA512

                                                                                                    798ae06936f3153d1a8744a7707a45ab2cd19b06446dd0c94147801542bd926c06f59771914514cef380da982731b1858d2c1c7d907c4a7e396324eeb39c5ae2

                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\LocalPrefs.json~RFe5b95e3.TMP

                                                                                                    Filesize

                                                                                                    434B

                                                                                                    MD5

                                                                                                    91888b8850545fbbebdf1c424a7ed999

                                                                                                    SHA1

                                                                                                    1f048f3eb04a2e1bce39401dc99b6ff275c07498

                                                                                                    SHA256

                                                                                                    f9998707d334ccc6d220af869d7ebca4037eec8af8c4ec5de17cb7c9e750d1ed

                                                                                                    SHA512

                                                                                                    df1c49c272115cf4e213debc09214e2bfcbe84b401f69a96c151ea5bd79fe44d70973c93e22a0a8869064a2152de98b9cce2e70a6bcfc231b707894e3d4b31ec

                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\chrome_100_percent.pak

                                                                                                    Filesize

                                                                                                    667KB

                                                                                                    MD5

                                                                                                    ae195e80859781a20414cf5faa52db06

                                                                                                    SHA1

                                                                                                    b18ecb5ec141415e3a210880e2b3d37470636485

                                                                                                    SHA256

                                                                                                    9957802c0792e621f76bbdb1c630fbad519922743b5d193294804164babda552

                                                                                                    SHA512

                                                                                                    c6fef84615fe20d1760ca496c98629feb4e533556724e9631d4282622748e7601225cf19dfb8351f4b540ae3f83785c1bcea6fe8c246cf70388e527654097c1c

                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\chrome_elf.dll

                                                                                                    Filesize

                                                                                                    1020KB

                                                                                                    MD5

                                                                                                    7191d97ce7886a1a93a013e90868db96

                                                                                                    SHA1

                                                                                                    52dd736cb589dd1def87130893d6b9449a6a36e3

                                                                                                    SHA256

                                                                                                    32f925f833aa59e3f05322549fc3c326ac6fc604358f4efbf94c59d5c08b8dc6

                                                                                                    SHA512

                                                                                                    38ebb62c34d466935eabb157197c7c364d4345f22aa3b2641b636196ca1aeaa2152ac75d613ff90817cb94825189612ddd12fb96df29469511a46a7d9620e724

                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\icudtl.dat

                                                                                                    Filesize

                                                                                                    10.2MB

                                                                                                    MD5

                                                                                                    74bded81ce10a426df54da39cfa132ff

                                                                                                    SHA1

                                                                                                    eb26bcc7d24be42bd8cfbded53bd62d605989bbf

                                                                                                    SHA256

                                                                                                    7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

                                                                                                    SHA512

                                                                                                    bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\locales\en-US.pak

                                                                                                    Filesize

                                                                                                    456KB

                                                                                                    MD5

                                                                                                    4430b1833d56bc8eb1f7dc82bb7f4bc9

                                                                                                    SHA1

                                                                                                    dc15e6306625f155683326e859d83f846153c547

                                                                                                    SHA256

                                                                                                    b44ddcfac9df4934007e6c55a3c7f5e7f14c7e5e29f35c81de917fc3b22aabbc

                                                                                                    SHA512

                                                                                                    faf93bf371b2a88c1b874a5e2c54e4487fd152ad19c2a406a46f55ae75ecd421a779888c2e4c170857b16bfb5d8744bc1815a4732ed50b064b3cbd0c5ffad889

                                                                                                  • C:\Users\Admin\AppData\Local\CefSharp\resources.pak

                                                                                                    Filesize

                                                                                                    8.0MB

                                                                                                    MD5

                                                                                                    4933d92c99afa246fc59eef010d5c858

                                                                                                    SHA1

                                                                                                    98d443654e93c73dd317f9f847f71fba3d5b3135

                                                                                                    SHA256

                                                                                                    62f4674daa15245ee081920b8ee191e72f36ca8fe24f6b986a832f45676915b2

                                                                                                    SHA512

                                                                                                    a3a69523c8e7310716daeebc06c2ba4fce673eccd1958e824ff179b82f4502d0ec095190179bbb387342e4150f952ea7533182fb6ba90377d17dafba8f4da623

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\98f034e8-97fa-41e7-b1b7-7e697fe5a76e.tmp

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    9e342246ae7a2c933c97cee8644b7bce

                                                                                                    SHA1

                                                                                                    071aa5064a36086124225c019707e433ac72aebb

                                                                                                    SHA256

                                                                                                    6d23eff45b898c1abac40c575a7baf47f4f7f6b2a6458bdb32da75eb111a2f69

                                                                                                    SHA512

                                                                                                    ba2ab124902592b1319ef00a82b5a1351930f8228ad5abb4aba98f015b69969b4246a69e6cca81291ccb3a7b17d9f889239d75d3a7f0a8e1dc458c5899730572

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    216B

                                                                                                    MD5

                                                                                                    06a3feca270d3e06ddbe152756fe2c75

                                                                                                    SHA1

                                                                                                    5fdfef97e607b511af6e19187df978327dba6b16

                                                                                                    SHA256

                                                                                                    17de5450e9536c544f1047c33f745256cba1d6155ebe8186ab04d2d45a4a4e5e

                                                                                                    SHA512

                                                                                                    735705cae2466ba14c08d6b99d3ffb4e50cc0d51d3a625893a9476acfb000483ec2f6fef2d121162db08edd5d5e3ed23a0966abced269937b7b51be86265ab7f

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                                                                    Filesize

                                                                                                    264KB

                                                                                                    MD5

                                                                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                                                                    SHA1

                                                                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                    SHA256

                                                                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                    SHA512

                                                                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    8ed727a60edc33d0ea189aceb637f361

                                                                                                    SHA1

                                                                                                    0adf2731518f2093b10f90558781418c60ea8e52

                                                                                                    SHA256

                                                                                                    3655b99e9e0f4db830c97124cc92722c8dd1ae5da72de66044e550a6582562c9

                                                                                                    SHA512

                                                                                                    6e14e0dd879dae33028b37d98f872750a5b84615b157f23918405bec6cd3603b9d4c150e941c3ad510a7f46fc3cc8135ef999be28deab275292a637b3e1be500

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                    Filesize

                                                                                                    2B

                                                                                                    MD5

                                                                                                    d751713988987e9331980363e24189ce

                                                                                                    SHA1

                                                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                    SHA256

                                                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                    SHA512

                                                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                    Filesize

                                                                                                    356B

                                                                                                    MD5

                                                                                                    248b9d871c69084dbb75b96c76cf1f45

                                                                                                    SHA1

                                                                                                    4408e1b4d79ca207bdc3966ad7cb95b8b252ef32

                                                                                                    SHA256

                                                                                                    4b8c1916505705d8cc916b99d2f446a9c6c30a5cc8847ba4d8461335385f5d31

                                                                                                    SHA512

                                                                                                    464a4e8ff3ffc64ed35f99d62f43f3fcdeb33cf39650ac298f312d5dccab0cb341892787e74963b3ca7c71505f3319fb5cbb5241de0424893136753a65bc0b30

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                    Filesize

                                                                                                    524B

                                                                                                    MD5

                                                                                                    023e88000bf11a313308603437a12cd9

                                                                                                    SHA1

                                                                                                    bc17789ac72d64153df25819d8ae2a921b6e05c4

                                                                                                    SHA256

                                                                                                    4847e57af4064821c1c5850bbd313a47c2d4057d5a059f6a347f76f6ab9e4fbf

                                                                                                    SHA512

                                                                                                    d91f9b5e2ba55ece2174f66cd4646d4f9873ffc46dab3ba52612e39d9b9d9d6ef2053ff47e3caa571255539ebf92fe63d990c009e3c8493af0f29f745bc862e6

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    0ec2e749366c6431125b1c2f6cab9676

                                                                                                    SHA1

                                                                                                    01ef35a795eae6863f7b54ff152af1dab95f4760

                                                                                                    SHA256

                                                                                                    ebe20c65416b83cf69ac7d4684010f58fd3209a0c43f61a9dbdb5675a4a0c0a6

                                                                                                    SHA512

                                                                                                    6208c35dcd996f61c766ad1b83fd8da42b50ea24936c5fb14320a462100dc8b59a64b7867233f24a01d8e4b0c756bfc2e38c1f9a3a79e7fff2197f024ca1d3e7

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    affa0d4e8fb13b3ab8c366a5574be5f8

                                                                                                    SHA1

                                                                                                    c5852f137ea73995d23efff69e9d87559beccfc7

                                                                                                    SHA256

                                                                                                    124c1081527c6546c02ae897faf983ad1eddfd384ff31599cd5d5204c7dff400

                                                                                                    SHA512

                                                                                                    1ba6b28439ebb568a5b229272b3c96a5cce092d241524486b05545ba4ca0641d32fd14c08ec13cb639eaa088d4f0ad16d9911996c040797e6af50a3b9635f13f

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    MD5

                                                                                                    7cd2a4db46d599828677fbea896dba15

                                                                                                    SHA1

                                                                                                    6108d39dfea30f27e48de3dc94e88ec899a4086b

                                                                                                    SHA256

                                                                                                    31e70d95a565e97ff81f41c36ff6f5bc14b59d0facc85db050857d7f48cb55fd

                                                                                                    SHA512

                                                                                                    1bf77f704000b46602af48a8db8520580d9c5ec159100e8bb5d1190728a666089fa5b217e490d314af989d0e7638fab772c550aaf489be732f23a2ae100643eb

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                    Filesize

                                                                                                    281KB

                                                                                                    MD5

                                                                                                    f76f87ff458e549878453c362e456f35

                                                                                                    SHA1

                                                                                                    b0fcb3473680503c059084b4cb916220ae5d1c06

                                                                                                    SHA256

                                                                                                    e02841837db348c42d0e4817ea91beb0f9a0f9de08c0471b388a0cb16452102a

                                                                                                    SHA512

                                                                                                    4d327a06c380c275c1b89afd1c06cf5d4b2e4f1b6b0ec9edc6e85a2f4f0eafc609e2ac8f988ce8d6468faa593eba8cae86b0ef8a352b124b7e1f65c695df5501

                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                    Filesize

                                                                                                    281KB

                                                                                                    MD5

                                                                                                    bb4dc4a0b1d25b89720b93c0dc245c47

                                                                                                    SHA1

                                                                                                    16cd1b0917cdef6ba1e23f0a0f7802229be2f409

                                                                                                    SHA256

                                                                                                    ad437ef5152388899d4b9eb7b628207a39e452d497bd7e7b1efdb31d84b6c851

                                                                                                    SHA512

                                                                                                    8d6f508114c02176eb1f79c3a9b4f7dc7122e83a0487215e2270a95823fc7ef6f03f77bf775b6d6f214a29ee9097012f785c7fcee225c4ddfedcbfaf8ac7449b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    c5abc082d9d9307e797b7e89a2f755f4

                                                                                                    SHA1

                                                                                                    54c442690a8727f1d3453b6452198d3ec4ec13df

                                                                                                    SHA256

                                                                                                    a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

                                                                                                    SHA512

                                                                                                    ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    b4a74bc775caf3de7fc9cde3c30ce482

                                                                                                    SHA1

                                                                                                    c6ed3161390e5493f71182a6cb98d51c9063775d

                                                                                                    SHA256

                                                                                                    dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

                                                                                                    SHA512

                                                                                                    55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    456B

                                                                                                    MD5

                                                                                                    21df655bde987f043cf430408dc48651

                                                                                                    SHA1

                                                                                                    6c23126e39c1af88dcc4564d91507705f7647072

                                                                                                    SHA256

                                                                                                    43a39df9ce0f94d8e1ddefa2c4c4d8d100fd8c784946488e36612c346e8b29fd

                                                                                                    SHA512

                                                                                                    37a1c979d6a7b4f1543d79e7ba987460c6cd85211069a0884f5eccef5a376b9e87e95a99b52a39608f3157894a8aeabaf427b57fcfd139bb88b240a1ceea9dec

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                    Filesize

                                                                                                    474B

                                                                                                    MD5

                                                                                                    13181f87122e09ed44e80b3fee1379c3

                                                                                                    SHA1

                                                                                                    4cfabf6861fb4e2ee4b2f972eef45bdd8b11f4f2

                                                                                                    SHA256

                                                                                                    ba78bc9982e7c24c0621755b995d10f4ae19de532fafaefff4fabd424a630aa1

                                                                                                    SHA512

                                                                                                    2ec0f52ddce2102420e1dcccd3326c8ad7d22aeba6625d6e4d9a71a7d85db05a922ffec938f7865e5f1f6b02bbaf4d1d5badad2d661d268a4617282da0c68e01

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    d706089ab19815e27d1089ad8bc1d9e7

                                                                                                    SHA1

                                                                                                    3c656f141094239176b14e3eef073652376239b0

                                                                                                    SHA256

                                                                                                    02502991c5451db5564e192c7df76f7f4409ad2a3fd35b9f3dcd263a4edb7813

                                                                                                    SHA512

                                                                                                    53fb2b4df23c8252d285d45dd1c16b800f464b96f587c00a1530be4010e7ee50557b4d9528c8fb9f40c7a01188996801484c3d2a1e3cb7777b7df30035d78a28

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    ed2a3850621582c66ffba69243a7a453

                                                                                                    SHA1

                                                                                                    3b65e868caa9abdc64cb2a097656c17ac5d4681f

                                                                                                    SHA256

                                                                                                    405c77438759ceb229331da15662a90e608769a2778eae63cc4a25901ead4485

                                                                                                    SHA512

                                                                                                    af73ea9586702f8dc950e0c91b3f4993fd6173e2805218230e4388f47f263439bee8e9b5f263fef9a01eeb43f56c6d9ec807f87118e4641944145d8a263b7984

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    94291d49c9c08aabaa942f5f42f0030c

                                                                                                    SHA1

                                                                                                    e026f627876022d1fdeb27d4cb2c4148aa6730ea

                                                                                                    SHA256

                                                                                                    d603c4209a5f36d945a6d15797054d12b34ea1608ab01271f57ab38e5bf2d4ff

                                                                                                    SHA512

                                                                                                    bb27583b4f7fe75b72defd7a5276d545bc070a341a1a73b887e208a764da3e9ab483391a4ce2495314d5b790dfdfc14fdf0eeb252b62983b58b1e9c7f31e0e91

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    6cb22391fbc2c055bf1da5e9dde998e9

                                                                                                    SHA1

                                                                                                    dfa3085536776d8a8f7225e5b206f5f7bb681285

                                                                                                    SHA256

                                                                                                    10b44236872e60294a0132f706adf1eaf93100bd8392a2ff478ad8b66e0cd0ec

                                                                                                    SHA512

                                                                                                    078679e2e09950623739ae4adf19f61b68ebe7b2021abaee661d51204d12ee63bab2fc9a9ea4666e52f87955a636083a1429d1bd5e9c26e1d1a8356750c31961

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    705B

                                                                                                    MD5

                                                                                                    57f4e4b8c6f68e630a36425e2a7db713

                                                                                                    SHA1

                                                                                                    f634a1aadd38b2e96d40eebab1fff3859049c776

                                                                                                    SHA256

                                                                                                    5d6ee20c9a8dfdf4e1c12b5e01fb35473e8b6fd6a0f148e2ec53b8b4815a9217

                                                                                                    SHA512

                                                                                                    60d325edc14265e5822a2ec968ad309705a79c5d029427066fb482f838710c48de083adc48c833d7ae943c740a7954c06ad51fa1de93ef328d2665d8597f93a9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584e0b.TMP

                                                                                                    Filesize

                                                                                                    371B

                                                                                                    MD5

                                                                                                    223d9ee51bb3e666d1c87c6c85b2b819

                                                                                                    SHA1

                                                                                                    5c41db3b33707bdcb5432450fddfabde5a087bfe

                                                                                                    SHA256

                                                                                                    cc2f549e407d43705727a1205e9613111619d24e3b2f78458ecdffa98827bb75

                                                                                                    SHA512

                                                                                                    860b638ee234efef0c99b50339cbe4627b1e12cbdaca649de057dae41ddac7e9a555788a9eb50a2a4f55530715ec00c78ebc8e6b34ffe27552e8a60ecc16c81e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                    SHA1

                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                    SHA256

                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                    SHA512

                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    11KB

                                                                                                    MD5

                                                                                                    8d95185ab646068b5a65933da3dc9c2b

                                                                                                    SHA1

                                                                                                    040751ea9980fccdc41b6308fa4b06ba4b173e38

                                                                                                    SHA256

                                                                                                    f0598c15aa85494075d8808137b264257bd528ec9d2662eab17765ff4ad534ac

                                                                                                    SHA512

                                                                                                    595b5fbc0a995e36d2e23b13265eaf4b04e839f2f94a8bae1b523886a31d986d37fade8da4e50d054408749f5858e17b0465889a6df9e611d1b773c8dd0b66d3

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    11KB

                                                                                                    MD5

                                                                                                    e0f1e4d4a33488420f9208d666103e01

                                                                                                    SHA1

                                                                                                    4f041ea286eb02040478019a9e53209a3086087d

                                                                                                    SHA256

                                                                                                    11864e94e18e224120cb612ffe19ce7e30bfc4c4ef3be3f937ffff4618506ac9

                                                                                                    SHA512

                                                                                                    3f2328d79948fc443beafaabd0fcb0bdb4bb8ff3f1ce171816ec413e4bfb71fbb9df2515b56f6b7a0f8f0e8de10a5d8832886e50db4774eea6a8ed331b45c374

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    11KB

                                                                                                    MD5

                                                                                                    cee1662ec6acca11de1f50e6a8235bf3

                                                                                                    SHA1

                                                                                                    e482fa36c05970125d8484ecd21c495c52de0c6d

                                                                                                    SHA256

                                                                                                    f04baf9924e07a1c10be270d7e01674f81d0a80baed2c5da043856ec80a11226

                                                                                                    SHA512

                                                                                                    0515f8b4609c48e223b216b56f18926212042b8cce68a693afd47e00621eaf58348d059815d4b1b4a1f8f63850ee68349b60834d6cdcc50566e1de9efda84b4c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                                                                                    Filesize

                                                                                                    896KB

                                                                                                    MD5

                                                                                                    eb656be5526a7481f7bc0cdffa838047

                                                                                                    SHA1

                                                                                                    119d745f44b50fd21f6a022f1bfdfa66aa717850

                                                                                                    SHA256

                                                                                                    aa7ab490bd5e59ad3c9c6779114575b4bb00f612fb8b510b128e4298a8adae5e

                                                                                                    SHA512

                                                                                                    f5cd326c8c2175171f122f85e3f541ff3f454b64cdd20c4e475d3aa28057aa73ddd5861595312728d872ab64c34dd14d181cb00d1bd6e8d50beb35c01f37278c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

                                                                                                    Filesize

                                                                                                    9KB

                                                                                                    MD5

                                                                                                    7050d5ae8acfbe560fa11073fef8185d

                                                                                                    SHA1

                                                                                                    5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                                    SHA256

                                                                                                    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                                    SHA512

                                                                                                    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                                  • C:\Users\Admin\AppData\Local\Wave\CefSharp.Core.Runtime.dll

                                                                                                    Filesize

                                                                                                    1.3MB

                                                                                                    MD5

                                                                                                    09cba584aa0aae9fc600745567393ef6

                                                                                                    SHA1

                                                                                                    bbd1f93cb0db9cf9e01071b3bed1b4afd6e31279

                                                                                                    SHA256

                                                                                                    0babd84d4e7dc2713e7265d5ac25a3c28d412e705870cded6f5c7c550a5bf8d5

                                                                                                    SHA512

                                                                                                    5f914fa33a63a6d4b46f39c7279687f313728fd5f8437ec592369a2da3256ccff6f325f78ace0e6d3a2c37da1f681058556f7603da13c45b03f2808f779d2aa1

                                                                                                  • C:\Users\Admin\AppData\Local\Wave\D3DCOMPILER_47.dll

                                                                                                    Filesize

                                                                                                    3.9MB

                                                                                                    MD5

                                                                                                    3b4647bcb9feb591c2c05d1a606ed988

                                                                                                    SHA1

                                                                                                    b42c59f96fb069fd49009dfd94550a7764e6c97c

                                                                                                    SHA256

                                                                                                    35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7

                                                                                                    SHA512

                                                                                                    00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50

                                                                                                  • C:\Users\Admin\AppData\Local\Wave\WaveBootstrapper.exe

                                                                                                    Filesize

                                                                                                    939KB

                                                                                                    MD5

                                                                                                    258a9cae6024c91784bbd8aa5379e86f

                                                                                                    SHA1

                                                                                                    fe1a808ba23053413359a78d5ec096b2cd540dd5

                                                                                                    SHA256

                                                                                                    3881840473ec5286189d2fc8e85f0f26a2532890055d1653da9580aa31b2d0e5

                                                                                                    SHA512

                                                                                                    b621ef432b430d2df0443fa0ebdd59dc7de6b32375c2fc83e8474838843c4abcf4a35f2b5f80e78911fc52336d71812ca9fbc9919314ea3b59bd26036a4ea5a5

                                                                                                  • C:\Users\Admin\AppData\Local\Wave\WaveWindows.exe

                                                                                                    Filesize

                                                                                                    7.5MB

                                                                                                    MD5

                                                                                                    7e09dde2226c18dde3c76471c01b3665

                                                                                                    SHA1

                                                                                                    94bb80704e14314331e007b942a64f423104644f

                                                                                                    SHA256

                                                                                                    4f9a703b0491de02519a343659f0a351f6ad09942cd82920995d5fa89e6571ae

                                                                                                    SHA512

                                                                                                    c61c911eb37c758f64ae9372eb4208210b6a964bb8604d3fcd3285805448b1801a91c519ed0294815f8167500654b423d19161a82c82f7935ec637c4038c93dc

                                                                                                  • C:\Users\Admin\Downloads\Unconfirmed 386433.crdownload

                                                                                                    Filesize

                                                                                                    6.0MB

                                                                                                    MD5

                                                                                                    b67c09157b260b02037a716d28d7c34f

                                                                                                    SHA1

                                                                                                    a6da5549351e78fda395b5381dcf9e14240390fd

                                                                                                    SHA256

                                                                                                    ceb6a0b8e1c27c75155ab28b9283fe488ae5daca15b0cc58ebfc009200c8e824

                                                                                                    SHA512

                                                                                                    61cc65311af74f83ea950ef54661a5421df67026f7760e257ae3701b3b339f554ac1b42a63f2adafe142ad71a81c545b6749aac0a4f5c78eccd90d072fb7bbad

                                                                                                  • C:\Users\Admin\Downloads\Unconfirmed 496475.crdownload

                                                                                                    Filesize

                                                                                                    1.5MB

                                                                                                    MD5

                                                                                                    c822ab5332b11c9185765b157d0b6e17

                                                                                                    SHA1

                                                                                                    7fe909d73a24ddd87171896079cceb8b03663ad4

                                                                                                    SHA256

                                                                                                    344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a

                                                                                                    SHA512

                                                                                                    a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d

                                                                                                  • C:\Windows\system32\drivers\etc\hosts

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    deca688b3a2d7e1224e65a13c66b405d

                                                                                                    SHA1

                                                                                                    5d088d911e53b05860d2294f081b7a56614c1b1b

                                                                                                    SHA256

                                                                                                    efe68251dcfee5e61bce15c9028f4e237c45e24f23f66d0c9acf5355ba709341

                                                                                                    SHA512

                                                                                                    8ed11f7e130d1d0d5f554849e9ad181f60d242d21aa6019307df20833e7646705716f591b13c9db0ba8643e8800816dd6b691572c80973f540fba14cc84d47be

                                                                                                  • memory/1716-846-0x0000000004820000-0x000000000490A000-memory.dmp

                                                                                                    Filesize

                                                                                                    936KB

                                                                                                  • memory/1716-845-0x0000000000060000-0x0000000000068000-memory.dmp

                                                                                                    Filesize

                                                                                                    32KB

                                                                                                  • memory/1716-847-0x0000000004A00000-0x0000000004A4A000-memory.dmp

                                                                                                    Filesize

                                                                                                    296KB

                                                                                                  • memory/4440-567-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-304-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-301-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-7917-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-7913-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-300-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-302-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-303-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-345-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-6403-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-412-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-783-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-93-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-98-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-95-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-298-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-94-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-572-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-568-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-96-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-97-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-860-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-157-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-7988-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-566-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-876-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-881-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-882-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-565-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/4440-564-0x0000000140000000-0x0000000140F65000-memory.dmp

                                                                                                    Filesize

                                                                                                    15.4MB

                                                                                                  • memory/5144-825-0x0000000005F30000-0x0000000006016000-memory.dmp

                                                                                                    Filesize

                                                                                                    920KB

                                                                                                  • memory/5144-824-0x00000000058D0000-0x00000000058F4000-memory.dmp

                                                                                                    Filesize

                                                                                                    144KB

                                                                                                  • memory/5144-7947-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7958-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7954-0x000000000CFB0000-0x000000000CFC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7951-0x000000000CFD0000-0x000000000CFE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7952-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7953-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7950-0x000000000CFD0000-0x000000000CFE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7949-0x000000000CFB0000-0x000000000CFC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-866-0x000000000F410000-0x000000000F764000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.3MB

                                                                                                  • memory/5144-865-0x000000000DDF0000-0x000000000DE12000-memory.dmp

                                                                                                    Filesize

                                                                                                    136KB

                                                                                                  • memory/5144-859-0x000000000D020000-0x000000000D0D2000-memory.dmp

                                                                                                    Filesize

                                                                                                    712KB

                                                                                                  • memory/5144-7945-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7976-0x0000000020770000-0x00000000208F6000-memory.dmp

                                                                                                    Filesize

                                                                                                    1.5MB

                                                                                                  • memory/5144-7961-0x000000000CFD0000-0x000000000CFE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7960-0x000000000CFD0000-0x000000000CFE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-833-0x00000000062B0000-0x000000000640B000-memory.dmp

                                                                                                    Filesize

                                                                                                    1.4MB

                                                                                                  • memory/5144-7989-0x0000000015A30000-0x0000000015F45000-memory.dmp

                                                                                                    Filesize

                                                                                                    5.1MB

                                                                                                  • memory/5144-7948-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7956-0x000000000CFD0000-0x000000000CFE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7955-0x000000000CFD0000-0x000000000CFE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7957-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-823-0x0000000005A20000-0x0000000005A6A000-memory.dmp

                                                                                                    Filesize

                                                                                                    296KB

                                                                                                  • memory/5144-822-0x0000000000830000-0x0000000000FBC000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.5MB

                                                                                                  • memory/5144-7946-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7943-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7942-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7944-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7941-0x000000000E770000-0x000000000E780000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5144-7925-0x0000000005700000-0x0000000005738000-memory.dmp

                                                                                                    Filesize

                                                                                                    224KB

                                                                                                  • memory/5144-7926-0x000000000A620000-0x000000000A6C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    640KB

                                                                                                  • memory/5144-7927-0x0000000010F00000-0x000000001142C000-memory.dmp

                                                                                                    Filesize

                                                                                                    5.2MB

                                                                                                  • memory/5144-7928-0x0000000001670000-0x00000000016AE000-memory.dmp

                                                                                                    Filesize

                                                                                                    248KB

                                                                                                  • memory/5144-7929-0x000000000DCB0000-0x000000000DD16000-memory.dmp

                                                                                                    Filesize

                                                                                                    408KB

                                                                                                  • memory/5144-7930-0x000000000A740000-0x000000000A748000-memory.dmp

                                                                                                    Filesize

                                                                                                    32KB

                                                                                                  • memory/5420-805-0x00000000096D0000-0x00000000096D8000-memory.dmp

                                                                                                    Filesize

                                                                                                    32KB

                                                                                                  • memory/5420-806-0x0000000009730000-0x000000000974E000-memory.dmp

                                                                                                    Filesize

                                                                                                    120KB

                                                                                                  • memory/5420-803-0x0000000009650000-0x0000000009666000-memory.dmp

                                                                                                    Filesize

                                                                                                    88KB

                                                                                                  • memory/5420-802-0x0000000008930000-0x0000000008A30000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/5420-800-0x00000000001C0000-0x00000000002B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/5420-804-0x0000000009690000-0x000000000969A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/5584-578-0x0000000006680000-0x0000000006688000-memory.dmp

                                                                                                    Filesize

                                                                                                    32KB

                                                                                                  • memory/5584-582-0x000000000AB50000-0x000000000AB5A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/5584-435-0x0000000000E50000-0x0000000000FE2000-memory.dmp

                                                                                                    Filesize

                                                                                                    1.6MB

                                                                                                  • memory/5584-560-0x000000000A250000-0x000000000A288000-memory.dmp

                                                                                                    Filesize

                                                                                                    224KB

                                                                                                  • memory/5584-563-0x000000000A230000-0x000000000A23E000-memory.dmp

                                                                                                    Filesize

                                                                                                    56KB

                                                                                                  • memory/5584-576-0x0000000006500000-0x0000000006596000-memory.dmp

                                                                                                    Filesize

                                                                                                    600KB

                                                                                                  • memory/5584-577-0x00000000065B0000-0x00000000065D6000-memory.dmp

                                                                                                    Filesize

                                                                                                    152KB

                                                                                                  • memory/5584-580-0x000000000B3B0000-0x000000000B422000-memory.dmp

                                                                                                    Filesize

                                                                                                    456KB

                                                                                                  • memory/5584-581-0x000000000AB40000-0x000000000AB4A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/6044-1440-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1444-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1433-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1434-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1443-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1442-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1441-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1439-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1438-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6044-1432-0x0000027FA1730000-0x0000027FA1731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/6564-7915-0x000000005DEF0000-0x000000005E100000-memory.dmp

                                                                                                    Filesize

                                                                                                    2.1MB

                                                                                                  • memory/6564-7914-0x0000000000300000-0x0000000000335000-memory.dmp

                                                                                                    Filesize

                                                                                                    212KB