Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/11/2024, 21:18

241122-z5lz1azjby 10

22/11/2024, 21:15

241122-z38e8ayrhx 8

Analysis

  • max time kernel
    158s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2024, 21:18

General

  • Target

    https://cdn.discordapp.com/attachments/1285544843740708969/1309627983643938886/6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe?ex=6742459b&is=6740f41b&hm=12ace615ec56e9397c64221a08c691120e0caeb0ad609a5470990f51fea523b8&

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

162.251.122.76:7119

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-P2SX34

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1285544843740708969/1309627983643938886/6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe?ex=6742459b&is=6740f41b&hm=12ace615ec56e9397c64221a08c691120e0caeb0ad609a5470990f51fea523b8&
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3a146f8,0x7ffdd3a14708,0x7ffdd3a14718
      2⤵
        PID:116
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        2⤵
          PID:4292
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:544
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
          2⤵
            PID:4760
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
            2⤵
              PID:1364
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
              2⤵
                PID:1840
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
                2⤵
                  PID:2928
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4980
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                  2⤵
                    PID:3132
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                    2⤵
                      PID:1864
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                      2⤵
                        PID:4372
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
                        2⤵
                          PID:1448
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
                          2⤵
                            PID:4612
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5468 /prefetch:8
                            2⤵
                              PID:1180
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6444 /prefetch:8
                              2⤵
                                PID:3104
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,12253824256463968916,6795916517952378293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3576
                              • C:\Users\Admin\Downloads\6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe
                                "C:\Users\Admin\Downloads\6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe"
                                2⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • NTFS ADS
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4860
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6120
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZxiJIiRCztV.exe"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2032
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZxiJIiRCztV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp487E.tmp"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5172
                                • C:\Users\Admin\Downloads\6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe
                                  "C:\Users\Admin\Downloads\6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4840
                                • C:\Users\Admin\Downloads\6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe
                                  "C:\Users\Admin\Downloads\6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:2820
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4472
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4772
                                • C:\Windows\system32\taskmgr.exe
                                  "C:\Windows\system32\taskmgr.exe" /4
                                  1⤵
                                  • Checks SCSI registry key(s)
                                  • Checks processor information in registry
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:5472
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:3908
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k SDRSVC
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5580
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973.exe Memcache.It (32 bit)"
                                    1⤵
                                    • Enumerates system info in registry
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    PID:3196
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdd3a146f8,0x7ffdd3a14708,0x7ffdd3a14718
                                      2⤵
                                        PID:1448
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
                                        2⤵
                                          PID:5728
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
                                          2⤵
                                            PID:5744
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
                                            2⤵
                                              PID:5844
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                              2⤵
                                                PID:2852
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                                                2⤵
                                                  PID:4060
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
                                                  2⤵
                                                    PID:5288
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                                                    2⤵
                                                      PID:4656
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
                                                      2⤵
                                                        PID:2440
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
                                                        2⤵
                                                          PID:3368
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                                                          2⤵
                                                            PID:5516
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                                                            2⤵
                                                              PID:5520
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
                                                              2⤵
                                                                PID:1164
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,679505321366773125,12792048456589899973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
                                                                2⤵
                                                                  PID:4016
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:5668
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:4072

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    d7cb450b1315c63b1d5d89d98ba22da5

                                                                    SHA1

                                                                    694005cd9e1a4c54e0b83d0598a8a0c089df1556

                                                                    SHA256

                                                                    38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

                                                                    SHA512

                                                                    df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    74d75945aed1c6f3a3ecf9ef23a30acc

                                                                    SHA1

                                                                    7d49a615f48589f735b7dc003e83adabe7331fa2

                                                                    SHA256

                                                                    91ff472b5efa0b6dea52621534a58a90e7f6de9234c81658f939da89263c1da6

                                                                    SHA512

                                                                    98ec24fef768c385fdeb518beb0430510553de5d4e41dda8c7f737e44f9cb072caff867a2f6f4ac0b11303145e2de77e86891ef89ce40544e57c1d8f44b3aee3

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    bcbbf4e2fef25fee65008a76505d3087

                                                                    SHA1

                                                                    812c0f76f881ece87084ba8089d2af7932a6c119

                                                                    SHA256

                                                                    5f89e2800bd39c0b0f7d5472c194c8498beb6021231b94cf26a4bb46ac6e9074

                                                                    SHA512

                                                                    f228845a5670f4802fb405a6e0897664027c19ed7d7abac247ab6eccd8d53a91a23d5effe035fc093e497b2aee61f76152025c74343725f7af30ffe9971c403b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    37f660dd4b6ddf23bc37f5c823d1c33a

                                                                    SHA1

                                                                    1c35538aa307a3e09d15519df6ace99674ae428b

                                                                    SHA256

                                                                    4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

                                                                    SHA512

                                                                    807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

                                                                    Filesize

                                                                    44KB

                                                                    MD5

                                                                    d8062673a87d6bf885184001a2a75283

                                                                    SHA1

                                                                    4ce3ff245a1236cd2614760c5656358b916ea8c4

                                                                    SHA256

                                                                    ad310148636bd04238229e5e19a73fe111f35cb7410bb0048cc4692bbeecd4af

                                                                    SHA512

                                                                    37685a10447af6af2daae4f5d5c9650ce4de8d5e941720f3c98f27b824a10df2a096beb1ed77088c170deb6f9518b084aed19b9b0d8021954913c5e28597e96a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

                                                                    Filesize

                                                                    264KB

                                                                    MD5

                                                                    2171a3fac50e25a6cc35384df584e8c9

                                                                    SHA1

                                                                    cd51b08413d20e8fe2efe7165e5461d241b59a03

                                                                    SHA256

                                                                    18ba705ffe837c7f1fa55fa672fc19ed7114401a971cdc24197c7088abd66db7

                                                                    SHA512

                                                                    7821f2ca07630349b7b4d0a00639d5a8e20ddd5e09cc075c31b99518c9f76627618512edc61d2036f69ee609171dfc108e2318d9d78cd469a82ef581505c13d7

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

                                                                    Filesize

                                                                    4.0MB

                                                                    MD5

                                                                    5ca2024af4add6e1656cbdddf17f804f

                                                                    SHA1

                                                                    51521de2c6af4bc8c74fcf6f13531dbacea1436c

                                                                    SHA256

                                                                    f8d60b19d2277b78977ec8a6f4418a72eea2fdbeb25d07b0ff032e5ce245b622

                                                                    SHA512

                                                                    c465efd4f4eedc752c307e24f1823f8a94835dbde5385dba9380d92cb6176193193fedff4ad0a8d11810e0d2ca9dd05e39e363856b05f6301bc9b1b3c4e2d80a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    19a4ee07dec42e46e02499706ab64920

                                                                    SHA1

                                                                    3e3f72d9ec6dceae6c1fd5de3dca6a371f4d26db

                                                                    SHA256

                                                                    ad8a83f48bd824bb2ff185be2408a258d4868ad4e56cd42846406062117c3d22

                                                                    SHA512

                                                                    6855b3cb6718c11836e0e8a509ac01e24fc4b7b11ba67c3da102108044af990bd5b6a98e88bc4f61bc4830e54dbf8d508a01c4d42dc66d57c3235498a022d7e0

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

                                                                    Filesize

                                                                    20KB

                                                                    MD5

                                                                    62dcc55bf8b15c2415c7fd35eccef594

                                                                    SHA1

                                                                    9b7ddd8fd28a9864810eca063e452ca61eb93735

                                                                    SHA256

                                                                    69f3142a96e89b054cc929ba10219dbcd201e182682d390b48c2b528eb96f852

                                                                    SHA512

                                                                    d70bd0191bbdc38d765b2dec37a173a377b7b7ec53465b53d9e686d4ce0a9ad81dd745ed6cec031c02ea30f994808fe9de63eaea4c7aee009ee419400a14c55c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                    Filesize

                                                                    322B

                                                                    MD5

                                                                    74ed791ccc8d847fc460cfd4e0fd9259

                                                                    SHA1

                                                                    b0920f82512ffcee7643354cce32b606106a2b85

                                                                    SHA256

                                                                    3895d33cbbe90773d69e90f373d5534f06ffb36e7719fda1c8f19240ea59ac06

                                                                    SHA512

                                                                    a57281078f2d9353fd7c779d1426ec439098f2498e1c9877ec8921c88eab67eb6cdc2adb67be1f874db6b487175d2a0cbb76e62ecfd9ba6afeef977ed2e8662f

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                    Filesize

                                                                    124KB

                                                                    MD5

                                                                    6c646bf56a9f7e67273261c624838538

                                                                    SHA1

                                                                    ac2bc95057102ff3612c89965d701b7fe6a5d98a

                                                                    SHA256

                                                                    e2f48164f38459b0f733d775bee30818303883ba9885385789f87b267747bc50

                                                                    SHA512

                                                                    20e5767fea70d6bd1a59973cb8c83b59cb4e8a056eae57d01dc49ea197540011778928386f35985528889f87c2ef3f8906c19c3971ee096c4c19e81c4d80b72c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

                                                                    Filesize

                                                                    6B

                                                                    MD5

                                                                    a9851aa4c3c8af2d1bd8834201b2ba51

                                                                    SHA1

                                                                    fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

                                                                    SHA256

                                                                    e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

                                                                    SHA512

                                                                    41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                    Filesize

                                                                    44KB

                                                                    MD5

                                                                    78f1c88beba9dc43617bcc9470cd5d77

                                                                    SHA1

                                                                    243a0e37430aec0a9179e07e42126c41acbc6422

                                                                    SHA256

                                                                    1443d1657d3f3133a119f6a48cff530aba8d39af6e86090519a03d5bc691770e

                                                                    SHA512

                                                                    2d88da0efa683e79df6cdb9b7b004afe5063754964ffb70b29f6cd0a648ad3e28e4dac968055ffdfe39b0bc7c3fab1becfd374339eb5f0cab55574bf942fab4e

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                    Filesize

                                                                    331B

                                                                    MD5

                                                                    4c2c466a477efaab2048230f41cd467e

                                                                    SHA1

                                                                    bd279c099360bb5a298fa4d978a0dc1a5e265e1c

                                                                    SHA256

                                                                    94790939db6478cb841e36c3c1a5df3550c029b868041402eba7dc26761662cd

                                                                    SHA512

                                                                    bbd56bb312d5f63f3f95ca8ca9128d838ea01d09b14e271a0ab0b7fbada419e0d12e720a1f225bd7b2b908c81329206aac277dd614e036be4bb94a3c3bb380cc

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    186B

                                                                    MD5

                                                                    094ab275342c45551894b7940ae9ad0d

                                                                    SHA1

                                                                    2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

                                                                    SHA256

                                                                    ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

                                                                    SHA512

                                                                    19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    8325a67e662a03d5a456a33c7b113e20

                                                                    SHA1

                                                                    a041e2e17ee1eaecf965c6306d05a7f2c5ed031b

                                                                    SHA256

                                                                    26c9c5aed9335f8caa9a2a39f4d96c85a34a410af690e7617d6740b31612494f

                                                                    SHA512

                                                                    f0db6dd16aa4e6c664a4b8da34e8b0dc7540073416683259c1761b3ad0894ca488bb7d62d572fb68b1f298edfc1b407bbcb008ad98e33ade6f3015ba91a013a0

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    c04eb30d0e0da17186ba7311924982c7

                                                                    SHA1

                                                                    363f3622582e9ca8d7665a415f9672071fd19512

                                                                    SHA256

                                                                    375c41d400b9acc324322d3e4d409691992bbf9d59a00e11764af1a84cbfad90

                                                                    SHA512

                                                                    2d8898b3526f374270ede594ab72c16e440b11466c7d76b15f82cf781af0b823f17c4ad3c2bd74e7a6bb20c8f46482ffea8e200fc009e65bcea7aff94690131a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    10928b18b6aa906fe7c7cacc22acc376

                                                                    SHA1

                                                                    bde752edc2a28474893117d615e7c3b89bf399fe

                                                                    SHA256

                                                                    e2d343c1e792e23441e501dd25394e526f1b5890fbb95b894a6e0b8a291f3b5e

                                                                    SHA512

                                                                    75dcba6b283f2d117d04f4f1f132d93fc3bf88f1b6a1c416b0e0f6c2a50503b56535e59cb63f1375f7a47e8c13481247dd5dff5240688d925daa53a180b69107

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    826eb5476adf88700fbca2dfc14d69af

                                                                    SHA1

                                                                    6154215b9d460883a217efa867856f10043a9417

                                                                    SHA256

                                                                    07a0fc46690726251d8630ec654b9f4760a845f541a14e07d34f3e271dd56df4

                                                                    SHA512

                                                                    0920dd17e363e5148bfe7cc546b1c56fbcd047eb8d586c3285ec61db8b75e5511f45a7b1995307d3236ed1cfb5f89abcb4fe79deaa8a3b1b02f1daa577edb60b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    5KB

                                                                    MD5

                                                                    8b705ea9113f2ee11a136a6136367abd

                                                                    SHA1

                                                                    1e696d49b59d66bc786de2dc46c6882887ceaf94

                                                                    SHA256

                                                                    5bbdc227afec8f7933d06dd1b1ea17715f887f4924a24e3911253b888298d594

                                                                    SHA512

                                                                    3821a7171bd02714fb216b2a2e0b24f18b27ef57394e0aa92c6a1cdc1743a7d5bc7e83bfc2ef3e18ad883f201161510135555620bee15ac12d27dea0206eaddf

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    8608cbb6484daf946c6523511c27ee5b

                                                                    SHA1

                                                                    1c8ce52585d5f3955461f514509ce4b3da848c79

                                                                    SHA256

                                                                    cef72f6e2ea72d15d3909eb649fe16c04952db1dbd3fa5dc4513b4902c78a5b3

                                                                    SHA512

                                                                    a05ee3f21998de2423ffe250d2aa12d08aef4d808ebdce7341031e181711c3fce80dedfc4536cf18c87fad9dad06fd966150d1c1f1711048c286fafba0899380

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

                                                                    Filesize

                                                                    33B

                                                                    MD5

                                                                    2b432fef211c69c745aca86de4f8e4ab

                                                                    SHA1

                                                                    4b92da8d4c0188cf2409500adcd2200444a82fcc

                                                                    SHA256

                                                                    42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

                                                                    SHA512

                                                                    948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

                                                                    Filesize

                                                                    36KB

                                                                    MD5

                                                                    cdec28d5d2394f7a3fc3a168a39f2bee

                                                                    SHA1

                                                                    4ba47d561ed9a1ca8842145cff9fe61cbb562e8a

                                                                    SHA256

                                                                    fa4fab4e374000f6313918cdd4c18dd3612e69a933155940e3be2452fae56eb3

                                                                    SHA512

                                                                    b323eaa4993aa249a4104ef8f73cecea0db614469b071de9f4648b4ba2fde793aa1eaeb23d78f5479389340a7e20d20839b5728dc8c9609bb3f8bd6de83e230c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                    Filesize

                                                                    175B

                                                                    MD5

                                                                    6153ae3a389cfba4b2fe34025943ec59

                                                                    SHA1

                                                                    c5762dbae34261a19ec867ffea81551757373785

                                                                    SHA256

                                                                    93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

                                                                    SHA512

                                                                    f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                    Filesize

                                                                    319B

                                                                    MD5

                                                                    5960174f004f7255804c03f8c61ed11b

                                                                    SHA1

                                                                    edd705a67ff803224167b0ff017a341fd1e744d7

                                                                    SHA256

                                                                    c8ddc8ce966cc24dd12c74abd9bd8bde4360a54fa789beeccb0a78862b7f398e

                                                                    SHA512

                                                                    38ba53589aec075a4b4c91a456ef090c168a7da82b3ad51c03e01c89c808fe09a16dc2dd49daae3f91d5d36b6869e770c7f7b6b3bcf53deac66a98500fbe3132

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376783896136676

                                                                    Filesize

                                                                    461B

                                                                    MD5

                                                                    bd678efa69fbf6afa61ca69ed411b908

                                                                    SHA1

                                                                    b13d7c76889e86747d960e91c6fa8b8d453d27f6

                                                                    SHA256

                                                                    24ba493d4c8886c12959e20a31216819148a457a4cff8dd6c8d66038257f1d2e

                                                                    SHA512

                                                                    3a4577c192895303f25072ea2298ada9ccfdebef68f2b165da720021147fc5f74cdc7dfc71d23f63aace3048dbc2d3e32ff8866657b6280556793680edf1f941

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13376783896393676

                                                                    Filesize

                                                                    933B

                                                                    MD5

                                                                    238db2b4ba23ed7e67f13ca79168e9bf

                                                                    SHA1

                                                                    1d00068c2495290072d9f1202cedc29546ccaf09

                                                                    SHA256

                                                                    c399d8d445971a493471ac8d0cfe2d4ea96518042b55d97252ba6849ed3fbfb9

                                                                    SHA512

                                                                    3b069289c96fcc543a3e6af3c1910e585c8d2a3900a0b6552f421a5d2faccc79079400ee6b564ca9d608ce1e746df65095e89ee7a56ad535949b5919377b05a7

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                    Filesize

                                                                    347B

                                                                    MD5

                                                                    0873ea802638c5bc3e6c88c138e07fe7

                                                                    SHA1

                                                                    bbc80de7ff54d7546a87d207b4e4bfaf8693e9af

                                                                    SHA256

                                                                    2360a2f38a6e1f05e9f8e0bd63913ad2b1969be4d94e343133192f7cd705f5d2

                                                                    SHA512

                                                                    5004a65eaca7918f4f96d37332217f7caad5ee275458a7e46d8cfc0e0a1e22def981e03e063a02b2d69cbcf09b0ca8a735452b394224a522d20493ae06f378ca

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                    Filesize

                                                                    323B

                                                                    MD5

                                                                    14e7f4b91ac93ad0aaecaa5dacba5de9

                                                                    SHA1

                                                                    af701da5de655868949b6b784115f53fbafe2df6

                                                                    SHA256

                                                                    a7b95203a21ca6a88b6c5d269e15a9054654dc02a6b0a33f9ad08afd68d47552

                                                                    SHA512

                                                                    ef6dad2f33e5356f105528b98ebeed91b84968d0215be4085edf5d1345cc8adbf9d5275c48348ee2ff1893fc93758cc658e157f8682c75fe3a8001cae30e68df

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6975651-16ec-4791-b26e-495bb297ab0c.tmp

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    395bd1cdaded7efac492ac6438c99ca3

                                                                    SHA1

                                                                    81677d78e8f9a43655b4a87a8dc4c19582430eda

                                                                    SHA256

                                                                    c02720ae498a264ca1c7281bbd6a06438258f4d34d61aa3f04e6a8f04ecc54ad

                                                                    SHA512

                                                                    08ca95cdebc432ac8f21b88b59db9249dfa742c7d84539f89f99959bc03c865328ee9c3ea6782bd9f7a75e2c16751a9e390fa229edf9ae6de6482d692f70348f

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    aefd77f47fb84fae5ea194496b44c67a

                                                                    SHA1

                                                                    dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                    SHA256

                                                                    4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                    SHA512

                                                                    b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                    SHA1

                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                    SHA256

                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                    SHA512

                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

                                                                    Filesize

                                                                    136B

                                                                    MD5

                                                                    32ca8ca4aad41437ea3ead2dd0ab52dd

                                                                    SHA1

                                                                    907f10bcc62efd8d909b3bd6139c10f0b5ff39a0

                                                                    SHA256

                                                                    d5f9b9fa2130e01a8a958fec1b6d88c6fdc2af23efa0e82a565ee2d54dd1051d

                                                                    SHA512

                                                                    ea1feccaab9167ffd3029f319a7b27c4500911d6cb8d7f85d1de3883aead92c343db03f2e587792bc4de9d08839ff769e3eaf98ddd23725127002c1710aad317

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004

                                                                    Filesize

                                                                    50B

                                                                    MD5

                                                                    031d6d1e28fe41a9bdcbd8a21da92df1

                                                                    SHA1

                                                                    38cee81cb035a60a23d6e045e5d72116f2a58683

                                                                    SHA256

                                                                    b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da

                                                                    SHA512

                                                                    e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

                                                                    Filesize

                                                                    44KB

                                                                    MD5

                                                                    937ba1831bd60d58e23b8dde8972ef2a

                                                                    SHA1

                                                                    784f43877ef84feba4167fc1a6ed161a73df0673

                                                                    SHA256

                                                                    fdd1c066df1eb2b0e0a767c36d5e588a2c323554f9699ab2ec12613ce77bcce6

                                                                    SHA512

                                                                    47d9d8f787c856172d0d13582364e7e5b335452a37ff7cf960227ef5ed94be0b6475c949fe039fde697cf8a98624076ce3191782a22f3128bf2d6a2ad0352575

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    76dea14d3851cf9186c329f1b53ddc1f

                                                                    SHA1

                                                                    00d381b28c55f18b6ae24b2bba81dcfb8efe3e00

                                                                    SHA256

                                                                    75f6fc9bc6143f2218a10e35e13e8c1028cccefcf9ddef300b6dea10df53b26f

                                                                    SHA512

                                                                    1fc254c85715e658a1d139ce7ae8b7bbe87288b221dfb4e9e4b8940b6689af51adea71472b1db6cfe0702c4b90d3eda977782296c82820b5764f32a0095ebb66

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                    Filesize

                                                                    322B

                                                                    MD5

                                                                    659e4e2600ab6956f5e78af4bac17374

                                                                    SHA1

                                                                    bb907f16ac077161146825ad696fbfc514146c18

                                                                    SHA256

                                                                    9cd45ab526921eac6d2778ca59b4cbf2bdf6a4d6db40b464369286ae909dccae

                                                                    SHA512

                                                                    90e062c9b2dae2266d2b76037cac942204e9e5857ab1f06dcd5ef022b865c0e5b8de759453b0c526857cba3cb21838edd2635e5588f6b573e4b87d82728a4d4d

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                    Filesize

                                                                    565B

                                                                    MD5

                                                                    6fb545ce54aa4bbe7f518acb75ad2b63

                                                                    SHA1

                                                                    16bc653eb2769c057a10f24767fb85eb4caa7ae6

                                                                    SHA256

                                                                    b7aa397ae1dd1a558a197c91ac7bc4a3909ecdcbfbbf690c1e6aa492d14311ee

                                                                    SHA512

                                                                    9b570e8239310a74c4f6e72b2e235e974b38de521d6b32dbbf2a5f80bb0413ce90ff52e6e484e716324e70ba4c8b7b923215441c94979d3710a8a485bae10f38

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                    Filesize

                                                                    340B

                                                                    MD5

                                                                    dd3c1f10ceed76c5f54778454c5251dd

                                                                    SHA1

                                                                    8f8dcf4b3582d805bd13ecc3cae515285c74c7b2

                                                                    SHA256

                                                                    45e450f01e7edc4f8c17d2bea3916c3f6d82b9c0c12f955bdb6a5269a2b1172e

                                                                    SHA512

                                                                    26717f2b4b8ad5b037a5f780ecb95a84d9231627c7f360237891887cfa04d1fa97721e4f55319bea9771f3f209e910251fcaa80eb04b7848f1a9fe9ae48ba985

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

                                                                    Filesize

                                                                    44KB

                                                                    MD5

                                                                    960deaf477993f593d76fadc2eaf0dc5

                                                                    SHA1

                                                                    bdbed2518485d270a42d67900f12a015b9be78b4

                                                                    SHA256

                                                                    c11180787f9a4abd87fa65b8cb175921fae0cd4f89d611ae6129e0ccf78df8ef

                                                                    SHA512

                                                                    e8d9be2156b8f7ac19d9b1f4d3cf90cad61f10e5e834ecf19e107c97356758b081a751ec6e42cd17a2ac809baf93c0ef46577ad7c807b4df2b3bd425e20e5db3

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

                                                                    Filesize

                                                                    264KB

                                                                    MD5

                                                                    a39df23f1f5a2e5531d7711c5d5e013e

                                                                    SHA1

                                                                    f63209d776beb0d668402d354d0386cc43225216

                                                                    SHA256

                                                                    15675f6f7fc08222ebd8d5e03a829b8f35755bc2088e9a2cae8bfdc7a6eb2c6e

                                                                    SHA512

                                                                    9f6f9d4cee6640128f3d7564d655f99341307f4672c8b32c5821e71c2a283bcc2bc67e0b573035397c9df9304114f39ded8135d85c77cea9556cac7795830c83

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

                                                                    Filesize

                                                                    4.0MB

                                                                    MD5

                                                                    b84f780e442603b84fe8264d40075573

                                                                    SHA1

                                                                    56faf935b5fde94ea06b780f772f63ae76c0181e

                                                                    SHA256

                                                                    5b5045e72233c2dbd41422ed9b56ca6ff49886e5b3f3f308fdf79d0f7a769cc3

                                                                    SHA512

                                                                    e283b1e9e5aeba9077e83b6db4c644bbc0820dbed7fd306dd6bbe297a298767f8b614bef1224baa6d5baa20055f7fa7d2dee6dd843518a5e49205d6fd61a055c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                    Filesize

                                                                    11B

                                                                    MD5

                                                                    838a7b32aefb618130392bc7d006aa2e

                                                                    SHA1

                                                                    5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                    SHA256

                                                                    ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                    SHA512

                                                                    9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    11KB

                                                                    MD5

                                                                    528eb17e074f979670e1b4ec55dc5145

                                                                    SHA1

                                                                    faea67cfda332b52107ca9d7476c3cf22aed9a2b

                                                                    SHA256

                                                                    bdcdbb3d03e284f3fcebb4868aebf49fed38f7d13c84ef766af1721010a25343

                                                                    SHA512

                                                                    15dc2047230cbad7967200f77d6d36aadad767e3da499e8e96b3c37f72e04a9450c4cc7b14cb5bec11bd0c621fef6b982ec81330e500fb2b2e31b7074efbcebb

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    10KB

                                                                    MD5

                                                                    b5761cc870281ea343f002a19eeca7b5

                                                                    SHA1

                                                                    816ff4ad57a1df9a652072867b9936e25efe4662

                                                                    SHA256

                                                                    ac0401c380cdbc636a2b7fc0b78ea40b0dc5332695ce38a3e38aab1f78b1f55d

                                                                    SHA512

                                                                    39558f4180f5bd4172880dcf50c7c196ed96c3078ef36f69dc0e180fb9e467ad82bdd0b48a8a47b097dda95c21a432c9a998353052de9fc3988983ccc87cf257

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    10KB

                                                                    MD5

                                                                    58eeeba4389e4d310832ec719ba2755c

                                                                    SHA1

                                                                    3a92e3550c2cc1b0d02b926af8efc26bb74c688b

                                                                    SHA256

                                                                    c2e875877f9860533ed1aebba4b09ffdc2e515b570952fa6e66c7070b7104608

                                                                    SHA512

                                                                    73fcd4ade58e6c59ad220ae206ff127e9e149c2cea4b401689d1fb6f0b8e66c3c8b9ba9be224aa72345ce304dd0ff00c666a76169bff9604108e5bda3eee1d28

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                                    Filesize

                                                                    264KB

                                                                    MD5

                                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                                    SHA1

                                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                    SHA256

                                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                    SHA512

                                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

                                                                    Filesize

                                                                    4B

                                                                    MD5

                                                                    a7b38619284dbe244134cfe4f99e4224

                                                                    SHA1

                                                                    bdf465b05ad7308a7aa651e3d7625cf4bd131372

                                                                    SHA256

                                                                    c7f5b71feb108c94242d4e46317d196653354ddc1fc3b79f6e575d987e4d5661

                                                                    SHA512

                                                                    7ac7371ae86698fd94b4c7df001dd50674ae3c0184195d8a9e4d35141aac6e76e00e06d5a43b23f104dc3308d7a7bf8648ab7f283f961287dced0bd0ea0a01ef

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

                                                                    Filesize

                                                                    4KB

                                                                    MD5

                                                                    17f9737590804e4dc609d064b2224188

                                                                    SHA1

                                                                    719416dd74392b11e3dd7b86cd116205b87cf7d0

                                                                    SHA256

                                                                    e3e4b0a4c948929580a8d803fa1ad57702c8b34ed1691e66346f1adea4b3548c

                                                                    SHA512

                                                                    5a08994c9d59ec06f5cac6dc9edc7f9ba3b31eae59a46bc9445fe891ba92335a2fb554f63472bc54c16a29f6b10714e3760eb76faf9d894f58b9ba163b202f2c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                    Filesize

                                                                    18KB

                                                                    MD5

                                                                    9258f5b6e9dad527ab922e7e0a41773f

                                                                    SHA1

                                                                    2905c463076fcb39386dc946b6ece79d36b9c4a3

                                                                    SHA256

                                                                    dc7773e3fb5c21b27dd745408d28d8d7f1a9572f2a1b1c93ddd7c07d728cfcc9

                                                                    SHA512

                                                                    70b5a8c759540d807e5a240696d22fdec9ea3d6b89265321bbb913f7a5c578ca16107900143996a63ff3880e01d2b90e05948698e6947bdd311f8236b7a31f08

                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3j2xt44x.r4z.ps1

                                                                    Filesize

                                                                    60B

                                                                    MD5

                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                    SHA1

                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                    SHA256

                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                    SHA512

                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp487E.tmp

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    ec34255ea351482c0b4923f4866d4b2b

                                                                    SHA1

                                                                    7c4bcc49f91624ab8b438566959625377e46d07a

                                                                    SHA256

                                                                    b625b9cca41dd07813ff1bfb0b9dcd41a07f4cead79763c8b1ef63f301426d98

                                                                    SHA512

                                                                    6cd52a9c126e7fac5fe5a203b213fab29f83076c023ab971448a52d3cc3a7d0ad249d4f8a95ea80c92d087e256697ed9e83a54b4f4b11ee612db0a4d2248a070

                                                                  • C:\Users\Admin\Downloads\Unconfirmed 846999.crdownload

                                                                    Filesize

                                                                    972KB

                                                                    MD5

                                                                    a035a6cfbe07dadcd1a4f89cc77d99b0

                                                                    SHA1

                                                                    ab53ba007f55daefb7dbf7d82fa135fe3046a208

                                                                    SHA256

                                                                    6474ef699648b5f34d8739a9a102836b27e4dcfe718404fcd09a428d2e89a973

                                                                    SHA512

                                                                    d03baddf8283857fa4bd61cb3b279413761143605a9bc2a26e7303ac9cf125cff5d2c263ca97e30e79928c839d5ad617bb2328f615d445ad81d05771e49a010b

                                                                  • memory/2032-258-0x0000000007040000-0x000000000704E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                  • memory/2032-228-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

                                                                    Filesize

                                                                    120KB

                                                                  • memory/2032-260-0x0000000007150000-0x000000000716A000-memory.dmp

                                                                    Filesize

                                                                    104KB

                                                                  • memory/2032-262-0x0000000007130000-0x0000000007138000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                  • memory/2032-259-0x0000000007050000-0x0000000007064000-memory.dmp

                                                                    Filesize

                                                                    80KB

                                                                  • memory/2032-201-0x0000000005360000-0x00000000053C6000-memory.dmp

                                                                    Filesize

                                                                    408KB

                                                                  • memory/2032-256-0x0000000007090000-0x0000000007126000-memory.dmp

                                                                    Filesize

                                                                    600KB

                                                                  • memory/2032-230-0x0000000006CC0000-0x0000000006CF2000-memory.dmp

                                                                    Filesize

                                                                    200KB

                                                                  • memory/2032-252-0x0000000006D00000-0x0000000006DA3000-memory.dmp

                                                                    Filesize

                                                                    652KB

                                                                  • memory/2032-231-0x00000000756E0000-0x000000007572C000-memory.dmp

                                                                    Filesize

                                                                    304KB

                                                                  • memory/2032-200-0x00000000052F0000-0x0000000005356000-memory.dmp

                                                                    Filesize

                                                                    408KB

                                                                  • memory/2032-199-0x0000000004C10000-0x0000000004C32000-memory.dmp

                                                                    Filesize

                                                                    136KB

                                                                  • memory/2032-229-0x0000000006040000-0x000000000608C000-memory.dmp

                                                                    Filesize

                                                                    304KB

                                                                  • memory/2032-241-0x0000000006090000-0x00000000060AE000-memory.dmp

                                                                    Filesize

                                                                    120KB

                                                                  • memory/2820-225-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-221-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-285-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-283-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-282-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-281-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-280-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-286-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-567-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-568-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-208-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/2820-226-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                    Filesize

                                                                    508KB

                                                                  • memory/4860-86-0x0000000005B30000-0x0000000005BDA000-memory.dmp

                                                                    Filesize

                                                                    680KB

                                                                  • memory/4860-83-0x0000000000F60000-0x0000000001054000-memory.dmp

                                                                    Filesize

                                                                    976KB

                                                                  • memory/4860-87-0x0000000005DB0000-0x0000000005DBA000-memory.dmp

                                                                    Filesize

                                                                    40KB

                                                                  • memory/4860-85-0x0000000005A90000-0x0000000005B22000-memory.dmp

                                                                    Filesize

                                                                    584KB

                                                                  • memory/4860-84-0x0000000006040000-0x00000000065E4000-memory.dmp

                                                                    Filesize

                                                                    5.6MB

                                                                  • memory/4860-88-0x0000000006790000-0x000000000682C000-memory.dmp

                                                                    Filesize

                                                                    624KB

                                                                  • memory/4860-189-0x0000000006760000-0x0000000006772000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                  • memory/4860-190-0x0000000007900000-0x00000000079C0000-memory.dmp

                                                                    Filesize

                                                                    768KB

                                                                  • memory/5472-274-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-269-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-268-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-267-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-279-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-278-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-277-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-276-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-275-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/5472-273-0x000001ADF4EE0000-0x000001ADF4EE1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/6120-255-0x0000000007710000-0x000000000771A000-memory.dmp

                                                                    Filesize

                                                                    40KB

                                                                  • memory/6120-196-0x0000000004E00000-0x0000000004E36000-memory.dmp

                                                                    Filesize

                                                                    216KB

                                                                  • memory/6120-197-0x00000000055A0000-0x0000000005BC8000-memory.dmp

                                                                    Filesize

                                                                    6.2MB

                                                                  • memory/6120-214-0x0000000005DB0000-0x0000000006104000-memory.dmp

                                                                    Filesize

                                                                    3.3MB

                                                                  • memory/6120-242-0x00000000756E0000-0x000000007572C000-memory.dmp

                                                                    Filesize

                                                                    304KB

                                                                  • memory/6120-254-0x00000000076A0000-0x00000000076BA000-memory.dmp

                                                                    Filesize

                                                                    104KB

                                                                  • memory/6120-253-0x0000000007CF0000-0x000000000836A000-memory.dmp

                                                                    Filesize

                                                                    6.5MB

                                                                  • memory/6120-257-0x00000000078A0000-0x00000000078B1000-memory.dmp

                                                                    Filesize

                                                                    68KB

                                                                  • memory/6120-261-0x00000000079E0000-0x00000000079FA000-memory.dmp

                                                                    Filesize

                                                                    104KB