orcus | hxxps://oxy[.]st/d/iEYh

Analysis

max time kernel
309s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29-07-2024 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://oxy.st/d/iEYh

Score

10^/10

orcus nursultan alfa (prem)credential_access discovery rat spyware stealer

Malware Config

Extracted

Family

orcus

Botnet

Nursultan Alfa (prem)

31.44.184.52:15288

Mutex

sudo_3kpsys7y85z4fdhjp3rb8mhbg022ckhz

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%appdata%\universalwordpress\flowerdb.exe
reconnect_delay
10000
registry_keyname
Sudik
taskscheduler_taskname
sudik
watchdog_path
AppData\aga.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000500000001e595-637.dat	family_orcus

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Orcurs Rat Executable 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000500000001e595-637.dat	orcus
behavioral1/memory/6604-639-0x0000000000480000-0x000000000077E000-memory.dmp	orcus

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Nursultan Alpha (prem).exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	Nursultan Alpha (prem).exe

Executes dropped EXE 5 IoCs

Processes:

Nursultan Alpha (prem).exeflowerdb.exeflowerdb.exeflowerdb.exeflowerdb.exe

pid	Process
6604	Nursultan Alpha (prem).exe
6588	flowerdb.exe
6964	flowerdb.exe
3572	flowerdb.exe
5340	flowerdb.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

flowerdb.exeflowerdb.exe

description	pid	Process	procid_target
PID 6588 set thread context of 4488	6588	flowerdb.exe	197
PID 3572 set thread context of 448	3572	flowerdb.exe	253

Drops file in Program Files directory 2 IoCs

Processes:

setup.exesetup.exe

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Drops file in Windows directory 2 IoCs

Processes:

msbuild.execaspol.exe

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe	msbuild.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe	caspol.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

flowerdb.exeflowerdb.execaspol.exeNursultan Alpha (prem).exeflowerdb.exeflowerdb.exemsbuild.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flowerdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flowerdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nursultan Alpha (prem).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flowerdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flowerdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exemsedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133667200356877469"	chrome.exe

Modifies registry class 4 IoCs

Processes:

msedge.exemsedge.exeOpenWith.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2990742725-2267136959-192470804-1000\{1694EEA8-A356-4B6B-9311-8C3CF4DA86EC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2990742725-2267136959-192470804-1000\{E2BC53AA-C643-4175-A592-1F1B618A4183}	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid	Process
1664	NOTEPAD.EXE
3960	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeNursultan Alpha (prem).exeflowerdb.exemsbuild.exechrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exetaskmgr.exe

pid	Process
1244	msedge.exe
1244	msedge.exe
3680	msedge.exe
3680	msedge.exe
5680	identity_helper.exe
5680	identity_helper.exe
6564	msedge.exe
6564	msedge.exe
6360	msedge.exe
6360	msedge.exe
6604	Nursultan Alpha (prem).exe
6604	Nursultan Alpha (prem).exe
6588	flowerdb.exe
6588	flowerdb.exe
6588	flowerdb.exe
6588	flowerdb.exe
6588	flowerdb.exe
4488	msbuild.exe
4488	msbuild.exe
4488	msbuild.exe
6640	chrome.exe
6640	chrome.exe
4160	msedge.exe
4160	msedge.exe
1856	msedge.exe
1856	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
1860	msedge.exe
1860	msedge.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe
7000	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exetaskmgr.exe

pid	Process
1304	OpenWith.exe
7000	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

msedge.exechrome.exemsedge.exe

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
6640	chrome.exe
6640	chrome.exe
6640	chrome.exe
6640	chrome.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

7zG.exeNursultan Alpha (prem).exeflowerdb.exemsbuild.exechrome.exetaskmgr.exesvchost.exeflowerdb.execaspol.exe

description	pid	Process
Token: SeRestorePrivilege	6600	7zG.exe
Token: 35	6600	7zG.exe
Token: SeSecurityPrivilege	6600	7zG.exe
Token: SeSecurityPrivilege	6600	7zG.exe
Token: SeDebugPrivilege	6604	Nursultan Alpha (prem).exe
Token: SeDebugPrivilege	6588	flowerdb.exe
Token: SeDebugPrivilege	4488	msbuild.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeShutdownPrivilege	6640	chrome.exe
Token: SeCreatePagefilePrivilege	6640	chrome.exe
Token: SeDebugPrivilege	7000	taskmgr.exe
Token: SeSystemProfilePrivilege	7000	taskmgr.exe
Token: SeCreateGlobalPrivilege	7000	taskmgr.exe
Token: 33	7000	taskmgr.exe
Token: SeIncBasePriorityPrivilege	7000	taskmgr.exe
Token: SeBackupPrivilege	5376	svchost.exe
Token: SeRestorePrivilege	5376	svchost.exe
Token: SeSecurityPrivilege	5376	svchost.exe
Token: SeTakeOwnershipPrivilege	5376	svchost.exe
Token: 35	5376	svchost.exe
Token: SeDebugPrivilege	3572	flowerdb.exe
Token: SeDebugPrivilege	448	caspol.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exe

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

OpenWith.exe

pid	Process
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe
1304	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 3680 wrote to memory of 872	3680	msedge.exe	85
PID 3680 wrote to memory of 872	3680	msedge.exe	85
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 2332	3680	msedge.exe	86
PID 3680 wrote to memory of 1244	3680	msedge.exe	87
PID 3680 wrote to memory of 1244	3680	msedge.exe	87
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88
PID 3680 wrote to memory of 2692	3680	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oxy.st/d/iEYh
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbcf3246f8,0x7ffbcf324708,0x7ffbcf324718
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:7024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:7032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:7040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7964 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:6296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:7072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:7048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:6772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:6540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:6364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,10636357911269341901,17021399960329328229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4856

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19612:102:7zEvent16375
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:5016

C:\Users\Admin\Downloads\Nursultan Alpha (prem).exe
"C:\Users\Admin\Downloads\Nursultan Alpha (prem).exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6604
- C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe
  "C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    PID:2340
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4488

C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe
C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1304
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe.config
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:6640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffbbf75cc40,0x7ffbbf75cc4c,0x7ffbbf75cc58
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2328,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3420,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3708,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4396,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:3456
- - C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff6911f4698,0x7ff6911f46a4,0x7ff6911f46b0
    3⤵
    - Drops file in Program Files directory
    PID:7100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4552,i,9937320977508644429,14663633028757457630,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:6620

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:6148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbcf3246f8,0x7ffbcf324708,0x7ffbcf324718
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:6996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1540 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:6256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13335096731991198016,18270015515142196142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:6808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:568

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:7000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe
"C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:448

C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe
C:\Users\Admin\AppData\Roaming\universalwordpress\flowerdb.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5340

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ClearDisconnect.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
249823ea6ce895c8d67dbd3036d9c138

SHA1
106e04815737d5bb63707213769a815650c037c1

SHA256
00204c2966ec5de4140942e7ced51f6fa73ed25cd63152f8043665fb1178723f

SHA512
bb8c48083775037f043154ea1e917abe319f8f91ab0e13634ce4007b0222ccc2deacb281ad9418f272236152746c800d179396b6b8db188d5dfe9a3d71b6b8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
06822073a17a12b41d513c1c74be04de

SHA1
04ade2a3c7267e91855443d548a2351d0ed10c24

SHA256
d34f8e0266980f39ad0777a9c88284183daa7f9c0401f6d1546d00d95c41fb8f

SHA512
dcd18c29b6b2a3bf90ac58e7358648bdc2bf06edde4fd138193872034efa5ca74e60dcbe5a4bd460045971db8ee85b08ccd75d66f5251b4c310fe23c40240d42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
cf514e401a33c1a5e50290574431d922

SHA1
0a7e74195b6b1630f252461be3c0d1419b820470

SHA256
2520534c67eaa9eeb5953d2f3591c1d28ec7c675cf1e73656a8b0024642a9643

SHA512
dd5226cff5ab37e7928724cedb73bc4f8239bde64c085f4cbeac8e609e7e5d487f18dec76cf64aca0ee08386b13aed4cf195ba43ac2ae8fc14d016e29e677f83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
bce1cfaed408e1eb504a33058fea4f80

SHA1
1d0a2cde10bbf53c89ab379a9317ce150d697864

SHA256
c91bc1bbdb1f9dcb16a1b637027aa3ebb8d8fb8dde3e375a678b8822cc0f597c

SHA512
4aa8cc125ef9e6c0068a4523d9afc824ef3b179c670efe495b120a901394f93cac5517b408212abf03c44a85792115eb653a69f7be16c00588d4f7e415a87b0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
246bc4273d28edf0527508409580a9f0

SHA1
1ab54d097c131f3594c610f84a940f188429b54e

SHA256
4125083f60ccc526161925e7db209902559da1adffbda156c54c1a06d94e835d

SHA512
7231db1af003782e59e5420b97273204d4ba57204b25e97f1aaed22a556c0a2e2d1f5c0083e2e5d805bbefa65312970f5edd32ca39f2887763f13c3ae15ae6dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5d7e4f2f0bd31c657cf449cbec68cd14

SHA1
5b8f18e8356f452a994070ae692ee076e0600ee7

SHA256
3778240c26de94df7c17d1f5853f6b2d3fffc042263a675ce6d0e0d98161d1e2

SHA512
8f737c12046e4fd089a19010a4079c70228ee7c0cb9e159ced9224d9559595932c1a38266842a54b20c6df2b23a009582e0c4565c6a764a2233f2b4bdc9b657c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4c0568d94b3b94c57dbb731a1cb21763

SHA1
5167c0b4e1eb8f561c8eb3a25f78c2594f86a064

SHA256
970cc5aedd5d368e2f9fa44fff18c59d2810d0b88ae169df5f4b04332c582dc5

SHA512
6a0342426a2baa4f488e218d9cbc61ed32b994b4283c5ca4b091eff6bd50cbe49c3922a3c86189428a7dc4477c85a978dda5910c2c3e99bb8956b84ea582cf51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
2319042aa046507df8390c447d3a83f0

SHA1
01c88f90d1b58172bd7262d11fbcb8ff30d3ef27

SHA256
706beda1627b5f19768ee315b7122e59bc6407488d887fa6553db6cc61a420b3

SHA512
6a6a935770c45f06be364af8d4a374748480c4923c48d160eab8ff4d34fbdd554029fe720c3e13223b335af1ed9a6e940ab4a104ee197bb22a3b6d4a7f926109

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
9d08edb6fde3468d218b44106e421969

SHA1
08ea6308b351d6cb5d55fb290d55dfcb24e0cf06

SHA256
4ce339977b19d5589ab8c47a3696043e4849fa827d5ea00677f49b5126039a7a

SHA512
689d4e612077fd0319bcba5b2a1b91cfd752c0ce1cb1e5dc91946f6373180825a6be67c2f8fc41db773d700306da6ca517bb8960119091f6e23276e3890b8566

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
2e531548ca1d09e33231ca3eb41125dc

SHA1
7a7792de0848787eb8e1047680c440838d97d70b

SHA256
e50f29a0fd0aa7687d6322a1eb7124f9e6a90a33865db35db629f5c5c4dcb724

SHA512
15559c64b8f1cdd8f758f01b4f48525b1097117caba763e5fc8d548b6a23fbf1881f7460278f7c0c674c1430ea80c85c896dd424b4467c91a4133af236334a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
623a103d26404bbbc1d14f9114baaaf2

SHA1
b57e57321d41a6df338d875e26c33a36ad4baf6a

SHA256
1a745ca8b5f1be73a99c06756dbba7ec51228a9fac20cde5bc3d2ca242902b3b

SHA512
dc7d946aaf35af47bc0927c9cf8e7e52f506b5602d2fb876aa2f222e20e13ad09b4a70456721d8873f8385f4f6eeea5b62ddac9206a233d2fca05d9c5dceeaf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
40e71bf16b4f93f81356c990e38f237a

SHA1
e4d873a1ef20b3bbbd7f86b81423337b3fe9c03e

SHA256
d12bd3a0a89a794d7a42da4fbc6f98681edc3ba57e7559b34ef28b7edfa94696

SHA512
f2b4e3023bae8f30b88983b3f09226c7be2ae2eb65042b6445d44d73d2a74205b6f2f43610138c3852ac03c4abbaa710d30a667fde0d550a65df96b928421939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10b86c0e-c906-490c-b66d-66629b1e67e9.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
16KB

MD5
0492db1aa58e4b66a438225a53d2464f

SHA1
4f13f87d33079ee47e2772b2ce89369440abd01d

SHA256
905b0169fc2a4fd8f80154f2fd0ae0586380a8d3c9974d29bfc3c82b21e6ed4c

SHA512
a59a682029823cd1822dae1e402f562ae3909d493f0f5442fb443a9a639f9b1c1108afdc50f5f06d895813a1dbe1540bc36af29d7b387759a00445542c4e928c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
58c15672309fb6bac0c91b820aa92619

SHA1
85a3008eea3f2606af825241b13f6adb5e837ee9

SHA256
88a14ee307c256c6a49ca82345a7d151996ed44074c9174e58fcc2c8b207db7b

SHA512
9a744de3051e0c6a0da8d43d9483da9d0a07feb710c5a9febd3657449f70d66d7e8be0c2eb17e44719e01612b25f0af0bc0311656b753efef80e1382af1a27e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ceb691053fd292992b8271fedfed44cc

SHA1
c4fbb2b525f545cc4cd053ff239e914395e54ae9

SHA256
e90e405d942a42e09f1deb3e479ed3b24fb8e7f0908083c7457dcb150668dd14

SHA512
1194b93eb411d2b30df83b2475c07f90e8a5cdf9a990e4ddb55a1357bb6444d073f2239afc7ae89807558be203b62f6f72a0870f6f889cb79d3f7ec30a324736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_download.oxy.st_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_download.oxy.st_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
16334813a1474b874b7b6607bb073a01

SHA1
bc3bd9c259c63662959c0524986a111d8cd0daac

SHA256
1617a4bf8c80c06f788ad885a0cd8e906b895ede07a8664b212ff1c0c93a4f52

SHA512
5eec7c03f7915b85e9059d7787cc4fd0ee1ce5cacfdae1031e4410303f036d1eec6b5a095e8c7c975c619df026b049716cc482c5f4c89b03091b60857bcdc0d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
a066060f8b8276c77ee4c6e9d666b44a

SHA1
d9b12bce2b123cd9239bfec8d411c25fa40a74e1

SHA256
2fad4c0f3fb42f20fdb1cf910da3969ef09bbb0e7296e224c0bfa703140b7ce9

SHA512
69583fe090d8592b9f3ce4b81b9a08a6f839d764c1c23929fed3f54a86ac6b1cee7aae0dd5ee8be2b1ca1676edf6461a167606609f049f3f3604412cdb9278ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b33fa9235361a9e62ff262c19126214f

SHA1
039690559dc0276c382be715dd866c19dfc9dcf2

SHA256
64aaace2be81dd91c9016d9b4a5c1fe358ea57092bcc600f394d501c0aef362a

SHA512
38b8d985e2609709ee7013460c1ec7bf0a9367aabab0bea08ee4b9fb9cd6703ccea18e0003bf55f9f29e75183a27cdaa80a786368991c5955a9b69469b5a4cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
5044dd0b789a7b40fd522090d53474ec

SHA1
6bed082a660c68be6f4b46a075cba5727e389077

SHA256
37a64d3e0877127c6a00df5e6526742f3191dcfc2d264a037ba0e35e00df5708

SHA512
6a4aa87c803488827ea75f7ebee99841a5176935032ee94fd8221efef8ecb483d320222d3165032c5e84d7541156f1414640cf9b2884156eebf2de42de520db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
024d10e5f2fbfe87755b70258b6fb6fe

SHA1
73557555de521d802ac3a0048f2746ddc1349e3a

SHA256
86720495aa54f7eb67e9232e29b259e91d112bab44c15150fa33d263e210bef0

SHA512
9d1a8b3aa85f2377ac7b417d0a25c1176951bc7d60b4f0c735d5f43c023611c9a13dfd24737db819385f29adb8d2e911e092f9a522539ba3e22b1bfdd63fa3df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
e943dd5f7ee1d896ed6b18871ec944e5

SHA1
934ef0aac97376e33a49c6047714a4d43b3f4ced

SHA256
70f7a98fd152189b1af8de9019ade63255c8b797b20eec072ee1e23d7fdaac70

SHA512
5d4490a50d996eb61e8cfc7f52ee04fff5c4c09fd6d2638bdfab6d1e9a1b71df8060acfe6fb231b532f253fddc3697dcee32436b7159d150563cc0f4559bb188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
58bba3d239e6c0804a1c4da11814d1ea

SHA1
2a401ed5fd0e24ed78eff90ad2873fb2120e4642

SHA256
049a283e2f36b03e3a06e3a947ee53519ad1afbc2e57c406f245da4b5f58c088

SHA512
b87e76b5ef6bc26e907b3aed27a92c4c55c845ca3ddf3c7e796b3ff89d5488b43bf2ced29644e48c2ff68e35dd9e15128a0da7cd518d40d5dccecec015818d1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
360a6cad902bf479fbbdfa6f71887f44

SHA1
4a377b87da6f7394541d83bfcadf99c52f6b7a6c

SHA256
22622254f2ea5df22253f89174fa3e9f4ddf3c8f2514f20c9ed268783627efb1

SHA512
d52dcfe33e1845ee6f6174b84d03f286b3064ebeee51732cf63d221b2f2b85f944ab2589e847cbfb3e9cc0fa6a50247598c306ba155e7756b11dcf1ab08a78e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
68eac524fd59ab7a18a777bb1df25ea2

SHA1
940daefae8d3a69bd809467da41c09310b7afddb

SHA256
52a4a566a696ae87cf2c4d18caae45ef9f2c8c98faf25c898eca4e1543c19cce

SHA512
228e8baf2f4f2b6e2ee47973e5b7e23208c5b8db2f171f10998688a3052e113223802e02c7ba19a360713849b5f3d624959919fc244ce8b2a8bf67a717666d86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b6e8285649f37ca9641eb5e4af2bbe94

SHA1
acddddc7dbb711e6de4ff8a8ad58946a92ef367a

SHA256
54aae2c21c2779ad299b9813929ed2b8479c204fa1a7d9f6586a79b2f88ef871

SHA512
c33a86da92cd7132e853e599f79d5ab0b97e21992e155fc3b49b935147c8ea5940a787438505685925a464993668fc35c925d19a697f03fc98b46af75792f9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
c376cb42cb613e0c70031630a7aed27c

SHA1
6a70c258c215e990b44a39b266fe365aeaec7d6e

SHA256
2e7f273cb79a759d45d711cded62e4d6bcf204909e56e7e5273adfead0d11d77

SHA512
b5a952f158fe77dcd68bc53343c28f9656f495a2ea0abbc3b36a801dedcc1fb65f602500cfe034b9c9594979d5a7f7835efbc957b9a0da52877cd561588ac6b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ec31a893589a43bf3963677f32035f65

SHA1
67166c1404660b20f767b61cbba29699931affcf

SHA256
0c231ee51d00de0a767c6966c2feffe38e9ed91cc181fbd2f29623e00eb2e047

SHA512
ba289cc5552b5686da4afa9130ccd39ccf49b67a260864c21c1e8af5936548105d2d2ad3fca665c24b0df5f1115e157c06d2f36ddc2469b97e751937684dd03d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a8435.TMP

Filesize
48B

MD5
883ae7572b9bca37885e8df6fbbbd5ab

SHA1
83760e00da69e288886f1ddb3481ea322928a26b

SHA256
60f0b6f10a229a5fd4dac2cb88c8b96312fd11d13f3b73e3adf2db56f8389c5f

SHA512
b238db9487973f8adb68ed7b27e6d3fd303896a0dca479e728fcb4cbb14ba6d171d01f8bdec36b5fb5e557dd924c3951b8515630a1d92b185e42973c6f24be74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c293c79023b74a76fabb482ec8586c4a

SHA1
6c529625101b1cded0c827112162cc0989e07abe

SHA256
afdf9860ce456e7dbeebbeb514b6f23f53308e9bbd0dfe6aa1e963aea9c5bbb6

SHA512
bd8b47205e9c9317db63c133345ec692a2924e6b924a0419fa3da6f60a84edf48f8d5b7dfabe1e930d91fa591d8b8ae086d9d669fb80ada0cace3fa12d82900c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c55865a4222c9d60938ff39f144f00a8

SHA1
7a45914bbac569bec126f591b3725b67da9bb503

SHA256
0e963433a17c5a9e1f8590e27874fc1e88c882e595db3702eafaf2c265ddd864

SHA512
2e70b96b31fad2b70bfe66c305f5d81ad9676340ff2d1f793528c467cdebf8d8aa06cccdcaa40b4885988c84c684caf986a7d10311fd5c103c26fe865f33139e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
72bf4ee95b652588a2cc00ee54172fb2

SHA1
a968be7ce2a5b8a12ccc24d1646345fa2b72ae32

SHA256
ae17b73b1fc36ab6a57bdd9feec573ffc7a50c2883de0b2610b43e689d40441f

SHA512
1f741e1b676f6105ef3c9e2db4ac15c9320bd5b728d772bd202460fac16bb68cba74b0fc67e8e3575f4024ad4a49dfbaba215623d92cbe8b7915108d1db4604f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
38b7d8af49c2d90c5675171b0e4fce11

SHA1
05f93ef9b723fd208d02bbe3536224531af1d3ba

SHA256
b53734e650a6076df8d4747298667af83a450293b1937eff4e9a09159f081faf

SHA512
34ab40707e33d8910c0d85adb0387eca702035ca606ccd099ee51c9c015a96ccd51e9c013695cee593c5387af71a16395f44c6a90e0e30ba03c1c6d24318c604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5400af56210753551e79ea3b2c22d85d

SHA1
f2552d3dc946243bdd2172614ee58aeecd37beba

SHA256
47e7c1910c4da92b8835de128c60efe377a79d01026f4cf05a3c8f13518ba5b3

SHA512
e7d6055cfad3125df7718b31b8b6d1f2cf6ecc210e03fcfccfc221b840f8442117b1371cd664ced969e72c0fc1bfa934eb6d5107cf4a9b57387b3a209106cbd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
20ce3fecbeecdb650297d2379e677ffd

SHA1
4442f05f1e39b932282116eb6076fc8162ce213a

SHA256
270a61cc1651ac6fd72543e2372adacce87c5e315c921d8c37ecd8f8490cc571

SHA512
df2f33d3ecf256159f9181d3bbce3bc18292f1a00ab4b1da3935032812c90e0d005df79232f89f3f7c5b9c429721e9fe21744053e91b7aab9418068facd00454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6d69fa6-3598-4c91-b2de-c64da4206503.tmp

Filesize
10KB

MD5
34127c17cc91dcbae8548f722787c587

SHA1
f2b2606250513ebe9042adb62b57dc2062982463

SHA256
b14a38544b1ebcd72fccbce62a0d9860a8670552611d5e5866073fd8753c5d7c

SHA512
c3119e534372334a0d50fa633bd4ceb714fc3e5a541c3749ec599b2dfa7c0d8ff2b0adf66e9c662c4de9dda9144109f0d7c92ac8638c55e8607e3b2684bb45c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef4ed51d-d083-4822-a798-7ae8dee5a9bf.tmp

Filesize
3KB

MD5
4f314a50372ccc1df0e8b22674945c69

SHA1
fe9da03617e4ddd6994537370fc650939ccd486a

SHA256
63e723ddcd47e194c8b38dfd5b61590c9eb69fc8d875e32486366a53638b28c7

SHA512
fc34be4e51f94625bcdc7f9b59e6b6f1fd50cff95f2617ff0dda14d7b363f4f5c13dad6901e3f1cbbb64bbbe5dc28b6ac3c714863437cedd0746314752b936b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87648419c8c32357c8356f4c7717370d

SHA1
bbdd78bf9265f1d56cc2e675f470e14942cf5b2e

SHA256
3c22142838631d376ee0b048577628140751dcde3c61722b33a6433cc2fc05b3

SHA512
98d90684ca9caa79d51127ab097cc28d4cce17128e6a7506448fab4715f68cf532882c6b882e7d7f12aba599e92b4478822cef2d0e5ed7460c7ab070c770bb83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
44a51772e03538a62bf6698e08c3bff7

SHA1
21faf53a2f7d1fcdeca3ef0feb335038f4125146

SHA256
8e022cbde2457a19b01ded35ab9438cf319bcd4c0699eba2bc2fa9f7bb4c1aaf

SHA512
9264858b7edfe15cff742960e329ba216f13370d74bc988e1e69aa4341fbe76b998330b1bb934eacca2dccdeaa1083ccff331a701b536564e1ef87529e838666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9e16c4013b687a28cd6a2607b043ec2c

SHA1
e665a1c4b297a6bb539f06dc70a13ece2158f2e0

SHA256
70f2b996dd26ff71b3e9b9aa67e5676548e6736def4c1cfc460d2affd36d16e7

SHA512
dd1d80a070e2670a8c8d8857a8d89abe233cb78f873da20b32552523648f5a3cc4b0ec8ad9809e70dbd17ac0a2d11517c3eac48e1bbdeedc841e368826b85e47

Download Submit
C:\Users\Admin\Downloads\Nursultan Alpha (pre.rar

Filesize
2.6MB

MD5
ab8c6500da0272daddeb36ccdb7f7cb9

SHA1
16398d1a1debcb8e9202e5c18dcf753f3706ced5

SHA256
0c43b0e4fd4f24df5a2db515d7af5d6f127d2ff3bbcc96fb91fd82f7c40763be

SHA512
7d63e091b209e2d0c782cef5435098ad69ff786fab2cae60b3f6f872fd5e00e926c8da11fad7ef7949d9566e6b558527e6d5470aa2ed54f0655410cd4f4e15be

Download Submit
C:\Users\Admin\Downloads\Nursultan Alpha (prem).exe

Filesize
3.0MB

MD5
e2a52f78fc1dc2eb561fd5d77892d642

SHA1
ffe1dd532e08911537d01f51f21c1ce181f4ac71

SHA256
6b60666d6ace3a450d54fe7b915c46632172ca0d4127d87873f0c111560e66cb

SHA512
e7f2abf0165735cba2da3e40ac44941135bad31c38f15dae65b66a77d3239487f758c286b95cebc17a13fd27a561804f34104c8d8f42d21ea845b3de16df6c73

Download Submit
\??\pipe\LOCAL\crashpad_3680_OZAOOCQTZZRJTXTY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/448-1307-0x0000000007140000-0x000000000718C000-memory.dmp

Filesize
304KB

Download
memory/448-1321-0x0000000006A50000-0x0000000006A5C000-memory.dmp

Filesize
48KB

Download
memory/448-1320-0x0000000006A40000-0x0000000006A56000-memory.dmp

Filesize
88KB

Download
memory/448-1310-0x00000000083A0000-0x00000000083B8000-memory.dmp

Filesize
96KB

Download
memory/448-1306-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/4488-673-0x0000000007570000-0x000000000757E000-memory.dmp

Filesize
56KB

Download
memory/4488-663-0x00000000059D0000-0x00000000059E8000-memory.dmp

Filesize
96KB

Download
memory/4488-674-0x0000000008490000-0x00000000084E0000-memory.dmp

Filesize
320KB

Download
memory/4488-672-0x0000000007F70000-0x0000000008132000-memory.dmp

Filesize
1.8MB

Download
memory/4488-671-0x0000000007590000-0x000000000769A000-memory.dmp

Filesize
1.0MB

Download
memory/4488-670-0x0000000007400000-0x000000000744C000-memory.dmp

Filesize
304KB

Download
memory/4488-669-0x00000000073C0000-0x00000000073FC000-memory.dmp

Filesize
240KB

Download
memory/4488-668-0x0000000007360000-0x0000000007372000-memory.dmp

Filesize
72KB

Download
memory/4488-667-0x0000000007950000-0x0000000007F68000-memory.dmp

Filesize
6.1MB

Download
memory/4488-675-0x0000000006C60000-0x0000000006C78000-memory.dmp

Filesize
96KB

Download
memory/4488-664-0x0000000006800000-0x0000000006810000-memory.dmp

Filesize
64KB

Download
memory/4488-665-0x0000000006B30000-0x0000000006B3A000-memory.dmp

Filesize
40KB

Download
memory/4488-666-0x00000000072C0000-0x0000000007326000-memory.dmp

Filesize
408KB

Download
memory/6588-660-0x00000000067F0000-0x000000000688C000-memory.dmp

Filesize
624KB

Download
memory/6588-659-0x0000000005E90000-0x0000000005EDE000-memory.dmp

Filesize
312KB

Download
memory/6604-639-0x0000000000480000-0x000000000077E000-memory.dmp

Filesize
3.0MB

Download
memory/6604-640-0x0000000005020000-0x000000000502E000-memory.dmp

Filesize
56KB

Download
memory/6604-641-0x0000000005120000-0x000000000517C000-memory.dmp

Filesize
368KB

Download
memory/6604-642-0x0000000005A80000-0x0000000006024000-memory.dmp

Filesize
5.6MB

Download
memory/6604-643-0x00000000054D0000-0x0000000005562000-memory.dmp

Filesize
584KB

Download
memory/6604-644-0x0000000005980000-0x0000000005992000-memory.dmp

Filesize
72KB

Download
memory/7000-1216-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1207-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1209-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1208-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1218-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1215-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1219-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1217-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1213-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download
memory/7000-1214-0x000001B0432B0000-0x000001B0432B1000-memory.dmp

Filesize
4KB

Download