Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 03:37

General

  • Target

    f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe

  • Size

    903KB

  • MD5

    e34683e560b0c2a5cddcffe98956ea62

  • SHA1

    89a3dc3e4b06a8c4bd94bffc48adac82e620d910

  • SHA256

    f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054

  • SHA512

    4bf4a8fef3b740ba3e6a04bedaaa90970a60b72fc950d53de6e2bf597d89d5d399f9258f9f8088f0ea6304bfa219c5537271c9df59c463893d9589370a27ebff

  • SSDEEP

    24576:7CHszWooWQhqSJgZjY0ZbnC8DOCZs64HE:7CHNtqSEY0ZbntQ64HE

Malware Config

Extracted

Family

remcos

Botnet

2404

C2

107.173.4.16:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-QBT08L

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
    "C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1752
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:948
    • C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe
      "C:\Users\Admin\AppData\Local\Temp\f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3664
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3856
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3504
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFBA6.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5016
        • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
          "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
              6⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1268
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                7⤵
                  PID:3668
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
                  7⤵
                    PID:1988
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
                    7⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1936
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
                    7⤵
                      PID:1008
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                      7⤵
                        PID:1800
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                        7⤵
                          PID:2864
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                          7⤵
                            PID:4884
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
                            7⤵
                              PID:2244
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
                              7⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1816
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                              7⤵
                                PID:4432
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                                7⤵
                                  PID:1784
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                                  7⤵
                                    PID:2028
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                                    7⤵
                                      PID:2672
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                                      7⤵
                                        PID:1492
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                                        7⤵
                                          PID:1408
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
                                          7⤵
                                            PID:5428
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                                            7⤵
                                              PID:5528
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
                                              7⤵
                                                PID:6052
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
                                                7⤵
                                                  PID:4416
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                                                  7⤵
                                                    PID:4652
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
                                                    7⤵
                                                      PID:5956
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
                                                      7⤵
                                                        PID:4492
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
                                                        7⤵
                                                          PID:1216
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                                                          7⤵
                                                            PID:5440
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
                                                            7⤵
                                                              PID:900
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                                                              7⤵
                                                                PID:5816
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
                                                                7⤵
                                                                  PID:5204
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
                                                                  7⤵
                                                                    PID:5344
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
                                                                    7⤵
                                                                      PID:2664
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
                                                                      7⤵
                                                                        PID:5612
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                                                                        7⤵
                                                                          PID:5284
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                                                                          7⤵
                                                                            PID:5260
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
                                                                            7⤵
                                                                              PID:544
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
                                                                              7⤵
                                                                                PID:1404
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,16147685700201193665,7548424688603170187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
                                                                                7⤵
                                                                                  PID:3428
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                6⤵
                                                                                  PID:5016
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                    7⤵
                                                                                      PID:1316
                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                  svchost.exe
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2204
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                    6⤵
                                                                                      PID:5364
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                        7⤵
                                                                                          PID:5376
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                        6⤵
                                                                                          PID:5960
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                            7⤵
                                                                                              PID:5980
                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                          svchost.exe
                                                                                          5⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:6000
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                            6⤵
                                                                                              PID:5848
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                7⤵
                                                                                                  PID:3392
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                6⤵
                                                                                                  PID:5684
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                    7⤵
                                                                                                      PID:5276
                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                  svchost.exe
                                                                                                  5⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5296
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                    6⤵
                                                                                                      PID:2856
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                        7⤵
                                                                                                          PID:5872
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                        6⤵
                                                                                                          PID:5712
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                            7⤵
                                                                                                              PID:1468
                                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                                          svchost.exe
                                                                                                          5⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:4904
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                            6⤵
                                                                                                              PID:4692
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                                7⤵
                                                                                                                  PID:900
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                                6⤵
                                                                                                                  PID:3644
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                                    7⤵
                                                                                                                      PID:2228
                                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                                  svchost.exe
                                                                                                                  5⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:960
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                                    6⤵
                                                                                                                      PID:4284
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                                        7⤵
                                                                                                                          PID:2128
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                                        6⤵
                                                                                                                          PID:2340
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                                            7⤵
                                                                                                                              PID:5136
                                                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                                                          svchost.exe
                                                                                                                          5⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:832
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                                                                                                            6⤵
                                                                                                                              PID:5548
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc7e1e46f8,0x7ffc7e1e4708,0x7ffc7e1e4718
                                                                                                                                7⤵
                                                                                                                                  PID:5580
                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:1092
                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:980

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          968cb9309758126772781b83adb8a28f

                                                                                                                          SHA1

                                                                                                                          8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                                                          SHA256

                                                                                                                          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                                                          SHA512

                                                                                                                          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                          Filesize

                                                                                                                          152B

                                                                                                                          MD5

                                                                                                                          27f3335bf37563e4537db3624ee378da

                                                                                                                          SHA1

                                                                                                                          57543abc3d97c2a2b251b446820894f4b0111aeb

                                                                                                                          SHA256

                                                                                                                          494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

                                                                                                                          SHA512

                                                                                                                          2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                          Filesize

                                                                                                                          152B

                                                                                                                          MD5

                                                                                                                          6c86c838cf1dc704d2be375f04e1e6c6

                                                                                                                          SHA1

                                                                                                                          ad2911a13a3addc86cc46d4329b2b1621cbe7e35

                                                                                                                          SHA256

                                                                                                                          dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

                                                                                                                          SHA512

                                                                                                                          a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                                                                                          Filesize

                                                                                                                          65KB

                                                                                                                          MD5

                                                                                                                          c74489f38af9c35da06e303efdd81bf8

                                                                                                                          SHA1

                                                                                                                          0b6fe1b83b0e67e9494854ed3340b9f2048ce868

                                                                                                                          SHA256

                                                                                                                          82de249fcefe94d3c9ef4ea1c7e79964db15c77da30f06fbdf838ede96d01342

                                                                                                                          SHA512

                                                                                                                          b187cdae13496a6a727ae9387f95dba488cd9e9a2c370913c5d58630c9c46e13483c4f943d13710288b02e5a27a4c81faf6014be77c36606f2c522f675551c94

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                                                          Filesize

                                                                                                                          464KB

                                                                                                                          MD5

                                                                                                                          4cb103381d01620a0903b2740424bef0

                                                                                                                          SHA1

                                                                                                                          b6a41624013746e5ae4cef7313b700620178ae78

                                                                                                                          SHA256

                                                                                                                          7c6eec193672c93259e2786b8f2bdf52095e94a3602976d3fc2cc525e96a2733

                                                                                                                          SHA512

                                                                                                                          a581d6869df7039db5f16ceda188f10e2c77f6d5b034b3c9738dc2ad2f82b0968be42c4c35edf2ef460daf2e6b7fad6b369446f0c888f0c4140b05e843514394

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                                          Filesize

                                                                                                                          79KB

                                                                                                                          MD5

                                                                                                                          e51f388b62281af5b4a9193cce419941

                                                                                                                          SHA1

                                                                                                                          364f3d737462b7fd063107fe2c580fdb9781a45a

                                                                                                                          SHA256

                                                                                                                          348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

                                                                                                                          SHA512

                                                                                                                          1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                                                          Filesize

                                                                                                                          88KB

                                                                                                                          MD5

                                                                                                                          f57bd672fe614986d4123ee65ef4f1df

                                                                                                                          SHA1

                                                                                                                          2cc726dbf325b3a303602098110a3a0906c03ba1

                                                                                                                          SHA256

                                                                                                                          6b26decf834976a09886a7af692ab99d01936cb8e9367803053f29eddf13ab3d

                                                                                                                          SHA512

                                                                                                                          a1df656360c2f18b3043e48be62c3fbee2c55b66cbd8c2b29e42065071549a1a52ea6a26d55581d7088b075bed2aedaf2d3a0d7985ebf59f488394854c907495

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                                                          Filesize

                                                                                                                          34KB

                                                                                                                          MD5

                                                                                                                          522037f008e03c9448ae0aaaf09e93cb

                                                                                                                          SHA1

                                                                                                                          8a32997eab79246beed5a37db0c92fbfb006bef2

                                                                                                                          SHA256

                                                                                                                          983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

                                                                                                                          SHA512

                                                                                                                          643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                                                                          Filesize

                                                                                                                          17KB

                                                                                                                          MD5

                                                                                                                          240c4cc15d9fd65405bb642ab81be615

                                                                                                                          SHA1

                                                                                                                          5a66783fe5dd932082f40811ae0769526874bfd3

                                                                                                                          SHA256

                                                                                                                          030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

                                                                                                                          SHA512

                                                                                                                          267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                                                                                          Filesize

                                                                                                                          259KB

                                                                                                                          MD5

                                                                                                                          34504ed4414852e907ecc19528c2a9f0

                                                                                                                          SHA1

                                                                                                                          0694ca8841b146adcaf21c84dedc1b14e0a70646

                                                                                                                          SHA256

                                                                                                                          c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

                                                                                                                          SHA512

                                                                                                                          173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                                                                          Filesize

                                                                                                                          18KB

                                                                                                                          MD5

                                                                                                                          870b357c3bae1178740236d64790e444

                                                                                                                          SHA1

                                                                                                                          5fa06435d0ecf28cbd005773f8c335c44d7df522

                                                                                                                          SHA256

                                                                                                                          0227bd6a0408946e9b4df6f1a340e3713759a42a7677bdb8cb34698e4edf541e

                                                                                                                          SHA512

                                                                                                                          7fc902e787b1f51b86d967354c0f2987ea9fd582fef2959831ea6dbc5e7bf998a8f24ba906f0ee99ae8493aeb0c53af06bee106d60b448ac50b827c63b1ed169

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\36015954e9c7528c_0

                                                                                                                          Filesize

                                                                                                                          187KB

                                                                                                                          MD5

                                                                                                                          d583cda94a0c420157f6983b13529a65

                                                                                                                          SHA1

                                                                                                                          ae31d3d727209dc3cfd6c2083f61d8533afc8936

                                                                                                                          SHA256

                                                                                                                          631cd80a838826ae069987e1abcd9987df70b7480901461252d4fc6c7d565444

                                                                                                                          SHA512

                                                                                                                          4dc584d6da4b12ff1e39bc1729a115bd5f55ce040f4649f00856260822e681a7287f4aa956f33bb654cff722e228d6d6d9f89ec1d2816da91363e5b9a9a9d2d3

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

                                                                                                                          Filesize

                                                                                                                          272B

                                                                                                                          MD5

                                                                                                                          3bc8b1b2e3aa55a31d19d88113e0b117

                                                                                                                          SHA1

                                                                                                                          b9dcaf47ec8508bd2c2316eea65ab904ec7f0de7

                                                                                                                          SHA256

                                                                                                                          284b07511fdffcc7ad40bf2059c6d51efa9d451d5bf77ee003d87fbfd42d25e5

                                                                                                                          SHA512

                                                                                                                          9f5bbcbf4867643a97238a5fd575bba1b72cb18c327f86554f00bb90d9111b8ffad641ccf97fcab8b3e7259aae10e1595be268f37753c4de229f0ebc41dee563

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b888a45be8d5ea6_0

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          7c6479a48ccf05bb593fbba0a56509cf

                                                                                                                          SHA1

                                                                                                                          3b0a4ea7959b5909526b6ca73046fcb14d83d284

                                                                                                                          SHA256

                                                                                                                          949940a92ec2cf35c0b5ba591c51a6afb42236ee73c197b91418e200e1c046f8

                                                                                                                          SHA512

                                                                                                                          2b9922f6bf1ce92eebf08bf32b7516a59b493570ad32372168f5c7895ba4903cbe73da16f4d4f38831486cbf7c5fde56e45634b96d20cfbbc4f715c91708f8c7

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4eb4ba1f217e5309_0

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          3b0bc127eeacaef84917c3d33d5c4b1f

                                                                                                                          SHA1

                                                                                                                          1efd409b15151aee2add660066640703f6763e51

                                                                                                                          SHA256

                                                                                                                          9d05c31ceeec9c191043c6f2e3381e3d73d9c5535e7021c47b1fa7d70c7a5cd8

                                                                                                                          SHA512

                                                                                                                          cc5b77d28a110479776286d9f640a04cce425d3f6dcb6b16cd9c112bef7ed7297b52e654da510c8d1f35d39346b061d177e5e63e1c66553e14f4a4c3beaea053

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

                                                                                                                          Filesize

                                                                                                                          291B

                                                                                                                          MD5

                                                                                                                          1cf3d71023297cc06d1512f2a37d2f10

                                                                                                                          SHA1

                                                                                                                          387bf4bf1d11725e02d69ec400b9cc462b56551b

                                                                                                                          SHA256

                                                                                                                          c0da2d47ce89b36f95386e34cddcf4d1fb00e76d38f902e57307dbfc9abc8c4d

                                                                                                                          SHA512

                                                                                                                          9fb0ea2112c3b6d358a9c21b43c8e02ffe5ad8569e18f1fe4ff00218ce861898f60f8be8757d2084362908a0709a3c77d54395012feade341ac11732f8976b87

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8da6153505e57f2d_0

                                                                                                                          Filesize

                                                                                                                          297B

                                                                                                                          MD5

                                                                                                                          00d43f1e008380d6897bd371d6e9a741

                                                                                                                          SHA1

                                                                                                                          22a85b637fe4655dc81b55d50144275ffcb45b26

                                                                                                                          SHA256

                                                                                                                          3813745fb20925241e7b47c5247be95f59f72918d311899a83ef039006d9e342

                                                                                                                          SHA512

                                                                                                                          40e784c58cc3b57fbd50982729dc192b4ddfaa4f9c12f2262305fd8c43ddb7285fbbe6ff400d061bb69c7c93f77f45cd0b50ac53f1845c16683c76ee967ccfe2

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90f652e5e8d4540c_0

                                                                                                                          Filesize

                                                                                                                          1.1MB

                                                                                                                          MD5

                                                                                                                          fe39f20d5f60fa5dcb29ed70ac8932f5

                                                                                                                          SHA1

                                                                                                                          b4cf082be4d1622b3a469aa15b50d9c150a62450

                                                                                                                          SHA256

                                                                                                                          95f0b59fabf1d39b10f5d5b253e031940b8e7d0f627ac3edff1f91b69540d679

                                                                                                                          SHA512

                                                                                                                          6fb260f5cd584e26e0a6240194290b64a60ef7b1cc747dc32cf3520057177b70e0ba0f2c1011e180d86480ea8071074fc4cc723696ffbf2b7da8cb27dd090ce7

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c1e7c7fafbf8ea54_0

                                                                                                                          Filesize

                                                                                                                          295KB

                                                                                                                          MD5

                                                                                                                          13ab91e89fb0059d69eaa23d86f1499a

                                                                                                                          SHA1

                                                                                                                          f673e975195ba5028df2a0a07b05aec7c3bd8e5e

                                                                                                                          SHA256

                                                                                                                          a3154511d582a7e0e96a7e9ba51c8e326d2d2913a762e53a59e098a60319828a

                                                                                                                          SHA512

                                                                                                                          f6ea2fac782477a9a3f338cd3bb5d12205dad1e987d7e15d3ffbb12931db5cb51fd242f5f5d6f1d13020c91d61473b15eadcaa5b8295e776cc2cce90976d58ba

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

                                                                                                                          Filesize

                                                                                                                          269B

                                                                                                                          MD5

                                                                                                                          525b87b038419273b650f8f0026b9434

                                                                                                                          SHA1

                                                                                                                          22d7391ae6df8a63821850bd150d554ded5015ca

                                                                                                                          SHA256

                                                                                                                          3da1c8690a198de9b1218bf13e85fde3a7cf51e2edc71fc4d59a2cb2a01a7954

                                                                                                                          SHA512

                                                                                                                          771b2b0e694ad39190df339d20598dd42caaf1c93fda571893e867215ef2e1dc8bc9972c031938b860d1bd2bd3714e5b68a9af3fc3136ceeba5de8f070ec8b2d

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                          Filesize

                                                                                                                          437B

                                                                                                                          MD5

                                                                                                                          05592d6b429a6209d372dba7629ce97c

                                                                                                                          SHA1

                                                                                                                          b4d45e956e3ec9651d4e1e045b887c7ccbdde326

                                                                                                                          SHA256

                                                                                                                          3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

                                                                                                                          SHA512

                                                                                                                          caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          5KB

                                                                                                                          MD5

                                                                                                                          00ae43f52c585887e279c95e02fadd54

                                                                                                                          SHA1

                                                                                                                          7a8877ae1952f00319070f5ec89022b2050129e5

                                                                                                                          SHA256

                                                                                                                          e32a14439a8d6724933552a857a27fa732da91f1756eedf7c935555ca4d397c9

                                                                                                                          SHA512

                                                                                                                          85f2b83bcb865db315cd5f1eeb7ca13a2b8f9981d0662f3143aadae3a29ec002a30ce6fa192b1fc5f49749b1d7aa8d29abbbe424ed3515625b1751948bffea62

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          7KB

                                                                                                                          MD5

                                                                                                                          484840ff89584f400e77d16d7207c647

                                                                                                                          SHA1

                                                                                                                          1493edc8ef23e59efa725d8c7a4c1bd3258872b6

                                                                                                                          SHA256

                                                                                                                          771305e192ed0e8b15a58fd7262a3ec838864cdfcb654f57a8ea2c7336215a9d

                                                                                                                          SHA512

                                                                                                                          8a843cd13b8ff3ea3966b67354f405b96f1de8163573ac878368fbf6dc6f9a665e3febaccc88f4da1073bb15fd27e489363d7dde880195e48c3fc8cb1a0d5037

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          9183a92c6b2dfbc224f10a6225172577

                                                                                                                          SHA1

                                                                                                                          d4202ee1df225b9d331d7da01450145e3bd56aca

                                                                                                                          SHA256

                                                                                                                          abb043b43c76f430a88e31fdf41958a4931ff24a682331e1cf86bf95f7b492d1

                                                                                                                          SHA512

                                                                                                                          5746c84edd406df409d7c762f21b7caff4ccf79e786ae00bb8377d53e383b00b64eb3e3635613e06be4dece95fc28bf2f06ef26ba8a7d765ca98ecb08ad675ad

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          7KB

                                                                                                                          MD5

                                                                                                                          9fa1201bfe7148406605bb019db2f676

                                                                                                                          SHA1

                                                                                                                          bb10c43bea4ad43138bac86d4ad313fe3500f1a0

                                                                                                                          SHA256

                                                                                                                          7eea3b51abe242e7aab2e0ea45490ddd5de83c4a732b7e264d75e7011f675e01

                                                                                                                          SHA512

                                                                                                                          b41dd3c6f0d28dab57a0416f4ddb70cd8ef61aadc7fcfb716c872e955924deee6589b33af1ba754d92151b35efa935f923ded73c256e13ddf4ec8d3fd8d8ae1b

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          049b47474a58f041056697268f266e70

                                                                                                                          SHA1

                                                                                                                          c90a620e4bebe12517151de9f24eb3a993bfce4c

                                                                                                                          SHA256

                                                                                                                          f44d71e5c527d3aebda3f6cfeb50a4b6384b7e159faa557cbce1a0e2e67205b7

                                                                                                                          SHA512

                                                                                                                          875ce315213594cdd97008326bdd706acb67a8d9b7d7c4c5dadf66291f8e466e479c07dfcad353368e9e12b8673fb68e39273408349bf81bc0b890a3bf8b5922

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          ac76c4d1c67e5a5e7506acc0f9d1a14f

                                                                                                                          SHA1

                                                                                                                          742b9c8afcfcae6f71f404ad8c5cf69e17b5a8d1

                                                                                                                          SHA256

                                                                                                                          aafacea03b2c3512e5d65783af923a7283a6c2d6da825325d4996a0ff3524023

                                                                                                                          SHA512

                                                                                                                          ec648322dd117349cb2b4197d727d92aa0eecfab3cf35528d119ffd2231b46665822ea87b0420daf1e065f8eb22a3c84c883187b3b19a35af59c9ed3bd5dd04a

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          7KB

                                                                                                                          MD5

                                                                                                                          03294611c5f8abfd353ef0d918daaa43

                                                                                                                          SHA1

                                                                                                                          8c858cf061fcc4f851db12d2bc0f9321960d3f6f

                                                                                                                          SHA256

                                                                                                                          b0ef1de4a495296c6d4ce54ff1797844a1334618d3a5a811b3654cab268de046

                                                                                                                          SHA512

                                                                                                                          c1598fbfe4d3ff7bea5ef75511d86389ec56826f93f8cf110ff535f9f1ac47f6772d987843dd42161c9b04b6eaff1aaecc13e96aae68214a0a445c78ca5049aa

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          41beff7378ec7bb81b535d3a0671114b

                                                                                                                          SHA1

                                                                                                                          fd2142a728060090418cfbc78f91368d289e6c42

                                                                                                                          SHA256

                                                                                                                          695dc9ef2a763fc841a6013daa08c565783133e312771d7281bc331ff26c045f

                                                                                                                          SHA512

                                                                                                                          c6754026c4c9de69db306ad36dd3bb178bae4f8a5244c9df30703585279646213055b3dedfcad3357d6cb793160709b3644c95a5e799cdcaade0011a3e54f712

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          371B

                                                                                                                          MD5

                                                                                                                          bc77448a9b305df2021f6b78d1967658

                                                                                                                          SHA1

                                                                                                                          89f4a2c457a3d46f10d6b0c5749ca87a0cbfdb30

                                                                                                                          SHA256

                                                                                                                          c53f7d575aec21ae322ac55708086b06196ec2461beb1c1b8846da28ca3a9de6

                                                                                                                          SHA512

                                                                                                                          1c9cb3214439d94a9b52c8573377d357900b739948ad418fd906797f1de77e6a712987ea677823466876a87951cf1872618690d6bf21ed65c880a5db9e6d1ee4

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          371B

                                                                                                                          MD5

                                                                                                                          1ffd74e673a4128f167a69ec0868f748

                                                                                                                          SHA1

                                                                                                                          f573c39dbb18dec6d6a5d80bd4c537585cf5376e

                                                                                                                          SHA256

                                                                                                                          2064e74fce3590e34960a36a243378099c4ae79861777b3a0b2eccaaf22621dd

                                                                                                                          SHA512

                                                                                                                          4a7630f3c42f99d60a6d38013b1bd7264275513b5bb975291f16ca1677f400354f12b31c1ea43610ce19135b1c8d272ab7afd1a94fa7bda3eec2b38587394ec8

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          371B

                                                                                                                          MD5

                                                                                                                          6089c283ff731d86ad64df6812861528

                                                                                                                          SHA1

                                                                                                                          199c1d67bcb76ecd85d5623945b25ae97cba09ad

                                                                                                                          SHA256

                                                                                                                          90315a39ed70a7efbb2b799707d985fde97f6a5ff819f30a042fdaccaf8a4c75

                                                                                                                          SHA512

                                                                                                                          5ce31a5d252c9c1613c873b79dbb6f6a8e088e0f69712fc72b43522454dad78024644a4ec49bca405bdd2cb21009414fbd923ab2bc07fb85e54b0bfc44f576e0

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          371B

                                                                                                                          MD5

                                                                                                                          97216ba191f6c648adce73eb41fb5ad0

                                                                                                                          SHA1

                                                                                                                          5f5f9a758cf4bd5338cfae4f603f34ef7f3b7503

                                                                                                                          SHA256

                                                                                                                          608a6671a418881285e1d80298f8609af9eee65b0bf1f3a7e4216400462d20f6

                                                                                                                          SHA512

                                                                                                                          66da11df68d1eefd0558f2725ac2ca8cf659a6c13400f1735e23a0b157e1e36eda37d33ab3323b3e58e94dc624fcec2e84ad4fce42cdfe67dceb27a6e57f18ac

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          371B

                                                                                                                          MD5

                                                                                                                          3c15ead3cba9476e7d52dd249a80fb84

                                                                                                                          SHA1

                                                                                                                          8d2fb349aa233f4fe9a1269a4f527dea3101c2a7

                                                                                                                          SHA256

                                                                                                                          ae2e6d1cd81a4eec23cba6835d0f65f3ae2a5f1820a0d1b0057f5477b4e96d90

                                                                                                                          SHA512

                                                                                                                          0027309c1d1ebd054565d811a76ef0398b587990639f45150c1ffc967a6d3de96e9e53758dc8986b8ddcd9aa99e03ba35ded53ecc1e6a681e37f0f1cd71ad027

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          371B

                                                                                                                          MD5

                                                                                                                          7662a3049b5c8e39261b66c1eabf9a4b

                                                                                                                          SHA1

                                                                                                                          50406c57c5ee1071da810d96d249ed6d030e8ad1

                                                                                                                          SHA256

                                                                                                                          e753de6982d8043538f9052ca370591f0bcc36eab66ec32540125f1c131ad5b2

                                                                                                                          SHA512

                                                                                                                          0d1f39cb1a25a78eb3d92f91635fbb24fa033f88622634a12f047b109a9d224f6753c6c082f932d2e0660f34a0e22b21852bf6dd7e112e75c9212594277bae8b

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e07.TMP

                                                                                                                          Filesize

                                                                                                                          371B

                                                                                                                          MD5

                                                                                                                          f1f61b937799bbc14d067de96f232455

                                                                                                                          SHA1

                                                                                                                          6230f41e59ae81cc9c85197cb4622f36e41897e0

                                                                                                                          SHA256

                                                                                                                          f17a50f63bc23c3e16585f75794de144bed2584ef6cf8fa008c401d06a24f54b

                                                                                                                          SHA512

                                                                                                                          b24b8513021fb87cc3d77d9a9fedf817eed6687383f7f76a459eb20badba3fdaaf1a08747ea795546f2fbec0cd44c65b7928388e3a9e3e1a9d5ea04156836596

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                          Filesize

                                                                                                                          16B

                                                                                                                          MD5

                                                                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                                                                          SHA1

                                                                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                          SHA256

                                                                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                          SHA512

                                                                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                          Filesize

                                                                                                                          11KB

                                                                                                                          MD5

                                                                                                                          a06f5ec6610a5efccafb211f3cd623ec

                                                                                                                          SHA1

                                                                                                                          a1861481c0ff6db8280554ffa89d1e8b28ca3c89

                                                                                                                          SHA256

                                                                                                                          c79690a00ee9d2474707844b044da68fa6676796252df1f649b7292238d8324b

                                                                                                                          SHA512

                                                                                                                          2fa1cf23c890195f8672b72510d51441247108ee894794c7516fdea242883e0df1110cdeb9384b54c39bb9c0aaad878dd4cde0415327144ae642fceed57bac8e

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          18KB

                                                                                                                          MD5

                                                                                                                          ac1505474e2d61eb07d04eec0305481c

                                                                                                                          SHA1

                                                                                                                          bf9045a5a19b75e8490ef30145fdc2496a85a859

                                                                                                                          SHA256

                                                                                                                          06417354f2effb5243f3cb149a5592031958d293b041986d6de93df58a9aaa63

                                                                                                                          SHA512

                                                                                                                          e2a75be559727059609688d1108e712a3e0ad0999c53669ef49402c1ce928dc732ae6404a14c3c10bf278b9711fd4af425471052d85333c9dbea0fc0bbffae0e

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          18KB

                                                                                                                          MD5

                                                                                                                          2b16d0c7acab2b3b072b01f91ed63bb8

                                                                                                                          SHA1

                                                                                                                          342ebb512d12ce2f73d23c53fb5245c239d67e2a

                                                                                                                          SHA256

                                                                                                                          a9a9a26fee97c824787bad702b4741ef475610ae1d465ca91c57f75cf1062311

                                                                                                                          SHA512

                                                                                                                          f1397b5bd9fc7c7fa5afe32f8147b8f81c8b6204cea9abdc0590416c818f426c4189dc3b1f9e723a27007dd336bc1dbac206b562cdce2bdb242909fe16cfa5eb

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_asvn5whz.ecb.ps1

                                                                                                                          Filesize

                                                                                                                          60B

                                                                                                                          MD5

                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                          SHA1

                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                          SHA256

                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                          SHA512

                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          1312fad2ce7820a0b0f788b12214a446

                                                                                                                          SHA1

                                                                                                                          dc4defaa5640cebe332d98fbe737f426047cffa6

                                                                                                                          SHA256

                                                                                                                          98faa34cb8378ef8326f42591e0488a5ed4e0660d6641b31d0f5d4af0b18b561

                                                                                                                          SHA512

                                                                                                                          0812942e0dbec3243e37f8e3a89a46e6e6c9418a88e317b19974d5e62e9fb57a07d6b11272112e747a869f6fcaebb2c5ef6119b998b23c637643639b447cd24c

                                                                                                                        • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

                                                                                                                          Filesize

                                                                                                                          903KB

                                                                                                                          MD5

                                                                                                                          e34683e560b0c2a5cddcffe98956ea62

                                                                                                                          SHA1

                                                                                                                          89a3dc3e4b06a8c4bd94bffc48adac82e620d910

                                                                                                                          SHA256

                                                                                                                          f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054

                                                                                                                          SHA512

                                                                                                                          4bf4a8fef3b740ba3e6a04bedaaa90970a60b72fc950d53de6e2bf597d89d5d399f9258f9f8088f0ea6304bfa219c5537271c9df59c463893d9589370a27ebff

                                                                                                                        • memory/960-710-0x0000000001000000-0x00000000010E4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          912KB

                                                                                                                        • memory/1752-30-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/1752-148-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/1752-137-0x00000000070C0000-0x0000000007156000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          600KB

                                                                                                                        • memory/1752-50-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/1752-22-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/1752-124-0x0000000070110000-0x000000007015C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/2740-179-0x00000000008E0000-0x00000000009C4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          912KB

                                                                                                                        • memory/2936-31-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/2936-35-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-294-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-436-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-771-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-770-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-742-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-741-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-208-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-209-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-210-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-708-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-164-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-165-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-168-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-233-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-259-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-260-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-707-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-271-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-276-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-675-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-282-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-674-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-641-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-332-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-333-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-334-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-339-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-640-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-607-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-606-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-605-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-573-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-564-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-563-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-562-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-367-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-561-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-533-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-532-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-395-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-396-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-397-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-398-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-399-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-499-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-432-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-433-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-434-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-435-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-498-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-437-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-497-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3156-465-0x0000000000400000-0x0000000000482000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          520KB

                                                                                                                        • memory/3504-193-0x0000000070EE0000-0x0000000070F2C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/3856-181-0x0000000006760000-0x00000000067AC000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/3856-192-0x0000000007450000-0x00000000074F3000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          652KB

                                                                                                                        • memory/3856-182-0x0000000070EE0000-0x0000000070F2C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/3856-204-0x0000000007790000-0x00000000077A4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                        • memory/3856-161-0x0000000005DD0000-0x0000000006124000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                        • memory/3856-203-0x0000000007740000-0x0000000007751000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/4284-2-0x0000000005F50000-0x00000000064F4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.6MB

                                                                                                                        • memory/4284-4-0x0000000005980000-0x000000000598A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                        • memory/4284-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4284-3-0x00000000058D0000-0x0000000005962000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          584KB

                                                                                                                        • memory/4284-1-0x0000000000E00000-0x0000000000EE4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          912KB

                                                                                                                        • memory/4284-49-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/4284-6-0x0000000005BE0000-0x0000000005C7C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          624KB

                                                                                                                        • memory/4284-7-0x0000000005D80000-0x0000000005D90000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                        • memory/4284-8-0x0000000006C00000-0x0000000006C0E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          56KB

                                                                                                                        • memory/4284-9-0x0000000006C40000-0x0000000006D00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          768KB

                                                                                                                        • memory/4284-5-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/4904-609-0x0000000000C70000-0x0000000000D54000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          912KB

                                                                                                                        • memory/5116-136-0x0000000006DD0000-0x0000000006DDA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                        • memory/5116-142-0x0000000007080000-0x0000000007088000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          32KB

                                                                                                                        • memory/5116-134-0x00000000073B0000-0x0000000007A2A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.5MB

                                                                                                                        • memory/5116-99-0x0000000005A40000-0x0000000005A5E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                        • memory/5116-138-0x0000000006F60000-0x0000000006F71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/5116-139-0x0000000006F90000-0x0000000006F9E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          56KB

                                                                                                                        • memory/5116-140-0x0000000006FA0000-0x0000000006FB4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                        • memory/5116-123-0x0000000006A20000-0x0000000006AC3000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          652KB

                                                                                                                        • memory/5116-141-0x00000000070A0000-0x00000000070BA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          104KB

                                                                                                                        • memory/5116-112-0x0000000070110000-0x000000007015C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/5116-14-0x0000000002110000-0x0000000002146000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          216KB

                                                                                                                        • memory/5116-122-0x00000000069A0000-0x00000000069BE000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                        • memory/5116-111-0x00000000069E0000-0x0000000006A12000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          200KB

                                                                                                                        • memory/5116-135-0x0000000006D60000-0x0000000006D7A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          104KB

                                                                                                                        • memory/5116-147-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/5116-16-0x0000000004BE0000-0x0000000005208000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.2MB

                                                                                                                        • memory/5116-15-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/5116-17-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/5116-19-0x0000000005280000-0x00000000052E6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/5116-28-0x0000000005420000-0x0000000005774000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                        • memory/5116-20-0x00000000052F0000-0x0000000005356000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/5116-18-0x0000000004B60000-0x0000000004B82000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          136KB

                                                                                                                        • memory/5116-38-0x0000000074A30000-0x00000000751E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          7.7MB

                                                                                                                        • memory/5116-100-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/5296-500-0x0000000000820000-0x0000000000904000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          912KB

                                                                                                                        • memory/6000-401-0x0000000000A00000-0x0000000000AE4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          912KB