Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-08-2024 18:40

General

  • Target

    https://github.com/MalwareStudio

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Possible privilege escalation attempt 4 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/MalwareStudio
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa049c3cb8,0x7ffa049c3cc8,0x7ffa049c3cd8
      2⤵
        PID:2544
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
        2⤵
          PID:2540
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4592
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
          2⤵
            PID:4480
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
            2⤵
              PID:4356
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
              2⤵
                PID:4212
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2284
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4620
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                2⤵
                  PID:1636
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                  2⤵
                    PID:1688
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
                    2⤵
                      PID:2788
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
                      2⤵
                        PID:3780
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                        2⤵
                          PID:2108
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
                          2⤵
                          • NTFS ADS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1064
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                          2⤵
                            PID:2960
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
                            2⤵
                              PID:680
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                              2⤵
                                PID:3532
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
                                2⤵
                                  PID:4664
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5400 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4344
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
                                  2⤵
                                    PID:4560
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
                                    2⤵
                                      PID:4632
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
                                      2⤵
                                        PID:1016
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
                                        2⤵
                                          PID:2764
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
                                          2⤵
                                            PID:1800
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15145623963026827156,15810680886217800321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
                                            2⤵
                                              PID:4936
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:2032
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:3236
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1892
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:1896
                                                • C:\Windows\system32\OpenWith.exe
                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3348
                                                • C:\Users\Admin\Downloads\Virus_Destructive_open_source\Virus_Destructive\Virus_Destructive\bin\Debug\Virus_Destructive.exe
                                                  "C:\Users\Admin\Downloads\Virus_Destructive_open_source\Virus_Destructive\Virus_Destructive\bin\Debug\Virus_Destructive.exe"
                                                  1⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2188
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k color 47 && takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && Exit
                                                    2⤵
                                                      PID:3440
                                                      • C:\Windows\system32\takeown.exe
                                                        takeown /f C:\Windows\System32
                                                        3⤵
                                                        • Possible privilege escalation attempt
                                                        • Modifies file permissions
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2912
                                                      • C:\Windows\system32\icacls.exe
                                                        icacls C:\Windows\System32 /grant Admin:F
                                                        3⤵
                                                        • Possible privilege escalation attempt
                                                        • Modifies file permissions
                                                        PID:3712
                                                      • C:\Windows\system32\takeown.exe
                                                        takeown /f C:\Windows\System32\drivers
                                                        3⤵
                                                        • Possible privilege escalation attempt
                                                        • Modifies file permissions
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5060
                                                      • C:\Windows\system32\icacls.exe
                                                        icacls C:\Windows\System32\drivers /grant Admin:F
                                                        3⤵
                                                        • Possible privilege escalation attempt
                                                        • Modifies file permissions
                                                        PID:1124
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UCviSYAcwdnDX1UoRzAHYgNg
                                                      2⤵
                                                        PID:344
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa049c3cb8,0x7ffa049c3cc8,0x7ffa049c3cd8
                                                          3⤵
                                                            PID:452
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UCviSYAcwdnDX1UoRzAHYgNg
                                                          2⤵
                                                            PID:3408
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa049c3cb8,0x7ffa049c3cc8,0x7ffa049c3cd8
                                                              3⤵
                                                                PID:2804
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UC9keh4wDjXFyiRhHDE_h90Q?view_as=subscriber
                                                              2⤵
                                                                PID:2752
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa049c3cb8,0x7ffa049c3cc8,0x7ffa049c3cd8
                                                                  3⤵
                                                                    PID:4876
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?sxsrf=ALeKk007atE4-A-mD40nsEcYaIJklYlv_g%3A1605092231197&ei=h8OrX5XEC4mdkwXO84XoAg&q=how+2+cut+leg&oq=how+2+cut+leg&gs_lcp=CgZwc3ktYWIQDDIICCEQFhAdEB4yCAghEBYQHRAeMggIIRAWEB0QHjIICCEQFhAdEB4yCAghEBYQHRAeMggIIRAWEB0QHjIICCEQFhAdEB4yCAghEBYQHRAeMggIIRAWEB0QHjoJCCMQ6gIQJxATOgcIIxDqAhAnOgQIIxAnOgQIABBDOgUIABCxAzoKCAAQsQMQgwEQQzoCCC46CAguELEDEIMBOgIIADoFCC4QsQM6BQguEMsBOgUIABDLAToGCAAQFhAeOggIABAWEAoQHlDzaFiDigFg86UBaANwAHgAgAHzAYgB7w2SAQYwLjEyLjGYAQCgAQGqAQdnd3Mtd2l6sAEKwAEB&sclient=psy-ab&ved=0ahUKEwjVo5bCqvrsAhWJzqQKHc55AS0Q4dUDCA0
                                                                  2⤵
                                                                    PID:3164
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa049c3cb8,0x7ffa049c3cc8,0x7ffa049c3cd8
                                                                      3⤵
                                                                        PID:4912
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UCviSYAcwdnDX1UoRzAHYgNg
                                                                      2⤵
                                                                        PID:5052
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa049c3cb8,0x7ffa049c3cc8,0x7ffa049c3cd8
                                                                          3⤵
                                                                            PID:228
                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                        C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004E4
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4932

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        4c3889d3f0d2246f800c495aec7c3f7c

                                                                        SHA1

                                                                        dd38e6bf74617bfcf9d6cceff2f746a094114220

                                                                        SHA256

                                                                        0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

                                                                        SHA512

                                                                        2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        c4a10f6df4922438ca68ada540730100

                                                                        SHA1

                                                                        4c7bfbe3e2358a28bf5b024c4be485fa6773629e

                                                                        SHA256

                                                                        f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

                                                                        SHA512

                                                                        b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\200d54ed-8988-46fb-a117-e53f2428f7f1.tmp

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        0fc135bab3cc36802e11d391da8be570

                                                                        SHA1

                                                                        46de93e65150a2f41fda9f3d44868f248de9d9b7

                                                                        SHA256

                                                                        86c052abe15bc9877cd5fd6060ffa25f3fea74494894f86eafc1746ac2f3c568

                                                                        SHA512

                                                                        0cdf4a0df2ecc3d316d139ae21d785054a0d0b2fc2ac3948a1ad354a01c6feec8a16e7c20b6488555a607717d1785b417a40c56815e5331986038c25453b7505

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                                        Filesize

                                                                        69KB

                                                                        MD5

                                                                        b1aac6cdebc56b22e0f956e6a2660706

                                                                        SHA1

                                                                        937bbb26f47e085f0e40e40c744358850ec50270

                                                                        SHA256

                                                                        e6f53ae132a7e7230dc77b53a87eca4c0d63f87105942445cf95c465852341e1

                                                                        SHA512

                                                                        29836206f7caff4e1c7e9e36f56e0e8d5df1dd9e4310b30083d536e25eb52eaa04d63c19a6219f785e7d6a68d38818e42657e3b9f168195da8ea561dc5482a5a

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                        Filesize

                                                                        86KB

                                                                        MD5

                                                                        3687bfdf6d983e236fe52ceaeefcc370

                                                                        SHA1

                                                                        fbc1ba63a5ae8c7adc90e5cc98f4a3432e2eed40

                                                                        SHA256

                                                                        7cef3024364336251e1946f1d30fd65260a71978ff1f5748c70ad79509ea0b78

                                                                        SHA512

                                                                        c54f88d037738cd7f76cf096da70f23d23de32262eb291e72fa9d0e17057b357c1d32584105e11c982bbd186f48bd4320896ab3e583ee3c0f89f14f4fcb3d6fe

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                                                        Filesize

                                                                        38KB

                                                                        MD5

                                                                        44be73cbdd27c00dd305585130866bd2

                                                                        SHA1

                                                                        925f4402694ccc9234a6895cf710f3aca77e8538

                                                                        SHA256

                                                                        f612c8db71758d077f4348079d8574fab3798b2789a82683cf2861f0b48d1bfc

                                                                        SHA512

                                                                        000073f8ddb8fb4f97a09f8fb89baca6a682c2053ac1dd2e0c8429ae05add05640e48b87867f0029e5db935e685235dfe9dd22d26d05447d2152c92396daf67d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                                                        Filesize

                                                                        31KB

                                                                        MD5

                                                                        a5e8e9a112bec8ae16fdec6750f9213c

                                                                        SHA1

                                                                        fc8f3c61cd051b92ffc6ae853961db17e21db144

                                                                        SHA256

                                                                        96d991a259f50f4eae2197de47b73535df40d3b578f5698bf8e3a40efa0c88ec

                                                                        SHA512

                                                                        aae7f9cd3d672bc1eb12e236fd5df56e8e0f021ffd9459b30362ad5affb2e0bbe71bd05823e272b3d26f769f155f6bdd9b75358899ff3603a06badf05bb6eb8a

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                                                        Filesize

                                                                        51KB

                                                                        MD5

                                                                        f61f0d4d0f968d5bba39a84c76277e1a

                                                                        SHA1

                                                                        aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

                                                                        SHA256

                                                                        57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

                                                                        SHA512

                                                                        6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                                                                        Filesize

                                                                        209KB

                                                                        MD5

                                                                        3e552d017d45f8fd93b94cfc86f842f2

                                                                        SHA1

                                                                        dbeebe83854328e2575ff67259e3fb6704b17a47

                                                                        SHA256

                                                                        27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

                                                                        SHA512

                                                                        e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        3d5206fa51ae1618007c23003e38ca23

                                                                        SHA1

                                                                        87e5abb6f9feb91b1133a4b6129ced8d7f3fe436

                                                                        SHA256

                                                                        7a923c146ff74902c938a41f23788488260f726a7877b1404e5b6497a4efc4de

                                                                        SHA512

                                                                        71cc357797f22fadcc4d9e3ed0056b0938689f07cd5aa86354ad1bcb5111c64d64be4be9f0dafd1ae93ef94b2d18fe37ffb010d317f126458151a1434619899e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        111B

                                                                        MD5

                                                                        285252a2f6327d41eab203dc2f402c67

                                                                        SHA1

                                                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                        SHA256

                                                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                        SHA512

                                                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        579B

                                                                        MD5

                                                                        be85a012866f82533b134a3e7c03581c

                                                                        SHA1

                                                                        8f361377763dc0f643a3c2746149ca5850c5d8c0

                                                                        SHA256

                                                                        7c0534066657219aeecf9763515dbb8eeb5b0cc4509d25ed75d5347476f443a0

                                                                        SHA512

                                                                        38aa3dc3c36a5319162d52fb0bdb7588dfa9fada5247c49ee53d870b7d928ea5be1387e176e8caf3dd6cad9b6975d432eae587c0103f8dffc56f17ef887ae621

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        e8102a64dfdc2dadf66cd0739d106931

                                                                        SHA1

                                                                        d06a420f85ec854e4a01393f3febd9efd3cda278

                                                                        SHA256

                                                                        81d32504d9d45498ee49583372e803afdde26ee164538ae2e7445c6ce2495d16

                                                                        SHA512

                                                                        65a0fdf02f7567645037cfe6efb2c71fdbeebb85937e274ca9ad347a71397c68ae24934e69358536b9c1b8763cf270efda69d6c7f82fbf6526a7797a05b63441

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        e059f8093265fd190518c601b9dd0c54

                                                                        SHA1

                                                                        9799a30922553b0d8caaa90849520b7d027d2c99

                                                                        SHA256

                                                                        d4e96e2a9430d714bc129625320ceda0b9ada48a34aa8afe6cf0d3b14edea0d4

                                                                        SHA512

                                                                        423e13b14679826f1274f1ee5aa14aaddb67609464fb804fd0d155ee174a778f9a93b1c2c2d24d7ed21dca6e4e7fc9e5788a32f5ec1791ebbfd168bbc43f4eec

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        5dac84ceec5ae23e27f2c8dd19ed388b

                                                                        SHA1

                                                                        e033fbbb73c85e02bed5581d9e3c40796bd6a840

                                                                        SHA256

                                                                        d5c25c438f3c2085aa37c866b9b4b09d6b180e8eb84736c94fb3b88e2fe49ac1

                                                                        SHA512

                                                                        d91c22fab2d5613427197ea53da9628ba55a78e50c1d1ebf5d446f47d65941615ac28350e7ba96d3b612cc2e7e161112e2bf8feecb69988d40f1dc247f792ab6

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        7a48e454a2595fa6ff18b805aadc443b

                                                                        SHA1

                                                                        58a2fb6378d78e6db65a6dc8d335546473536aab

                                                                        SHA256

                                                                        f12da711b61fab63c31599f2d4a92cfc7e3c0eb6ecaeffd6eb192621bfb116d0

                                                                        SHA512

                                                                        5c0b8ee9b720466c3d48cf7a109dc9e61c8a232fa2c921bf7f78358fd83abeb90304177eef3451eead0fcafa2cc51edb1bbb7eba9d3f72d0e9a5f1afba76d42a

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        94993989721551f79e9986f4502e3cc6

                                                                        SHA1

                                                                        04a5012638501fa6756f49d6d68a9c39c7b33149

                                                                        SHA256

                                                                        87b0d935bc585b7e7cd67e2634730220182b82bf6541698cbaf283736ad4b5d5

                                                                        SHA512

                                                                        572476c4acf89dbabd5317de6c63656bea88cb69eb7ca58b5ed8727f882f0c8d5d464cf166a1e54eae83dc0fc022aeff7305d21323f7be8929054cc40dc82e7e

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        f26db303f92403f605ea97280a94fca7

                                                                        SHA1

                                                                        802a03c8b58b83fa66f8c918ba67d322f6c1eb6c

                                                                        SHA256

                                                                        0adf22cb78343495d79fd8d987c0c4facbd50e8275d8d07c1aa55ac7b16cdf04

                                                                        SHA512

                                                                        1a3bb9e4816660c38393644070e2c48292f7631d645e31d35e761c3b1bbfe2012fce2a2c9df5d14a1de7c19ff6f584c2d5752524fad7c9f3b8f8071f749667a6

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        c3421b7b83f6d2df65a924da80b2ff67

                                                                        SHA1

                                                                        a2aa7654c96fa80bafc1b8bdcfdb9e79ff1d7afb

                                                                        SHA256

                                                                        5a6dd446840701e7874190b7b40d89bc39eb625506c5cc623fcc0abf6718bde9

                                                                        SHA512

                                                                        305f1b1d7388f12759799007f1819b59a55f181ce33d1df3b51577a1b040a80050b6eb44758735064d0cc0cd1e4f9c903ca14f63ea182a6c5affcf4865c78e4a

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        55a8221946b915a70eccf22f240fc13e

                                                                        SHA1

                                                                        ef1235466d938bca999a666a45495a674e4824dd

                                                                        SHA256

                                                                        326576a1548a9dcb7f4b1efe84c3d9774d99a260ed763a12002c6bd641d92dfa

                                                                        SHA512

                                                                        058485ea4cae7e419dffe3342816066819a0cb2e8779d1d1fde6551a04fb18eadacc142dd254aaae3c90ef29ebf2bde668565a7b198df7aa75efc4fab1ffe9db

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        14d8d321b7c8f80344d82a507a882818

                                                                        SHA1

                                                                        8089f7cec9ed880f58d6ae1229c2e877744f042a

                                                                        SHA256

                                                                        b5f377cb7758979cc6ab70d327cf471c45120c2d0643ef5e1e8f2ccb4405a0ac

                                                                        SHA512

                                                                        7992aba3ee18a942f060dba03a68f4a11e3b09160874d9489bdb5950832b0c1e482956f598f32d49118c7b8d93a575d30e5eb92d63ee62d053ad25957834dbca

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57edbb.TMP

                                                                        Filesize

                                                                        874B

                                                                        MD5

                                                                        a7ede015946f2dea150ada16d19d5c8b

                                                                        SHA1

                                                                        f9d31172a7ffae92ebac4536cba945a260bfdb42

                                                                        SHA256

                                                                        4e2ad03cbeabb70b06bab860846752ae61c894ad2bd67ed3d2da1b193c92a304

                                                                        SHA512

                                                                        77449af68a22223a93e826d64c22b0ad1e06211a97d5560b2a0e701ccf709117295ae1af524ba6b5e9919ba241936a370caaadfb7be294b9fa8e42ce69b63860

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        46295cac801e5d4857d09837238a6394

                                                                        SHA1

                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                        SHA256

                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                        SHA512

                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        206702161f94c5cd39fadd03f4014d98

                                                                        SHA1

                                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                        SHA256

                                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                        SHA512

                                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        bff38ab127a995fc48f7586211047f4f

                                                                        SHA1

                                                                        7a2e1dc592bf4b84cd8b24b9750d2838773d32ef

                                                                        SHA256

                                                                        a844368e567585cc4936a23a9140e52a249012e14cf7dd0860e64d780b1bb0d0

                                                                        SHA512

                                                                        20c0d8a7a6d6984cec63a82dec6be8acec4645924f4b21c544b903debececf05a2ec34ac0f1d8acb7c0ba0a19e97a9deac298b3f655a1d1be49b5c394b866d15

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        125169abcfb34b8d15ee3509ab4671dd

                                                                        SHA1

                                                                        4be027382797b8c38bca35996a57f71dadc0077d

                                                                        SHA256

                                                                        0876c2d7c9d6fff92b8b138e767ad68ea125ef6a6b57c15fb0259a900734e6aa

                                                                        SHA512

                                                                        52d7bd6ebdacc4c056245c84213f02cfd9f953b4cd9d32d57a62aeb9d0b61f52dd8425f1358119a6f607a3c4c5d1f0934e8ec34d6ad182c25b371bfc8f691879

                                                                      • C:\Users\Admin\Downloads\Virus_Destructive_open_source.zip

                                                                        Filesize

                                                                        283KB

                                                                        MD5

                                                                        0592f326bdc30a76214b2a145f6ef04e

                                                                        SHA1

                                                                        3d7f82338a8ec90d3effb7d3f123c4e05a3b6178

                                                                        SHA256

                                                                        bc4e2e5e6b47482339f33f041636fc1b03f7ae31c7aaf575ebc3a090fdd51d32

                                                                        SHA512

                                                                        161646245dec8cb4f9a6195968eba8fb721c613b4ed6736ecfa6198e67fa894ac49247d026d814e19ecd5b9b03ef86a8d63b1b510b81b3329269434c1104b122

                                                                      • C:\Users\Admin\Downloads\Virus_Destructive_open_source.zip:Zone.Identifier

                                                                        Filesize

                                                                        55B

                                                                        MD5

                                                                        0f98a5550abe0fb880568b1480c96a1c

                                                                        SHA1

                                                                        d2ce9f7057b201d31f79f3aee2225d89f36be07d

                                                                        SHA256

                                                                        2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

                                                                        SHA512

                                                                        dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

                                                                      • \??\pipe\LOCAL\crashpad_1980_HRQAMVWDQQRONBBP

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • memory/2188-411-0x0000000000810000-0x0000000000854000-memory.dmp

                                                                        Filesize

                                                                        272KB