Analysis
- user interaction
yes - max time kernel
1059s - max time network
1062s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
10/07/2026, 16:19
General
- Target diagerr.xml
- Size 1KB
- Sample260710-tsg8dscy3k
- SHA256 6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 3 IoCs
- Executes dropped EXE 5 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 14 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\diagerr.xml"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc0af8c728,0x7ffc0af8c734,0x7ffc0af8c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,2314779543534209899,11866447472468038049,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:114⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1568,i,4589325271544643454,10150373729842239789,262144 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,18281808593614821970,14146255712564883704,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,7107369233508896971,2750385329413438121,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,3728323850173924055,1458474454580308095,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,14324753074969564768,13614613567744453902,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,1064888027456872788,7379358785953348757,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,15511058980318774665,386327942463891166,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,872990085350329513,1544101653336694741,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,4915072964678285307,219992334239363448,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5480,i,1157410394527334810,17304394641490711435,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5520,i,15262971495057250832,5689323575712047060,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,10803695386538792670,6988141335860213522,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5584,i,9918452621781718934,13263249862708249585,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6020,i,10208595819457772755,7344822489509702868,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5812,i,3359578283833730692,18138453897446785540,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,10863418316483567044,16555884111716427214,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5576,i,17735716712845143658,11208612940964918957,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5708,i,3221107462468996917,18345190503455410710,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,342167474828382557,3689580647489864040,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5696,i,10849784505152896493,6259331245769600690,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5716,i,10407735403572544953,756354735593538024,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6168,i,10343668213042616450,1078862132211294170,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5628,i,13537223132261958622,7778692223468946870,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3540,i,12979782760961216539,209261024806634115,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6204,i,16407856734977599222,10030711967446536031,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,1877265945698233606,14187536856810431134,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,17882077562245934439,715374567251164208,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,2606740493143708212,5815961436055949007,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6148,i,4593359487216386557,7302713375569896362,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5544,i,14850597069864663328,1802235879947374394,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5556,i,10141892744214367299,16532888306234115203,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6292,i,4500083194611311007,18341056953796096820,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5856,i,709806398621651195,5424644236946423791,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,15238535619327007165,1117430657881017694,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5600,i,16655434141475140315,14590341211419439932,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,4229965368733532180,5512072378398063514,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:144⤵
-
-
C:\Users\Admin\Downloads\Minecraft Education Installer.exe"C:\Users\Admin\Downloads\Minecraft Education Installer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NBLGGH4R2R6?ocid=&referrer=psi5⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffbeca2c188,0x7ffbeca2c194,0x7ffbeca2c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,17235010062787709206,17362298406359756704,262144 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,4933784141557985520,2797756969987314866,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:116⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,5381579508473258194,17574228762501793815,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,7471433298154203336,1163961791680300158,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,7545639232224953121,1668761537658688485,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,7792335042109502871,11578737651732304202,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,3259850745676765433,10518176605995935200,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:96⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,4112849402583353607,4693767482479939652,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,1143205254429600984,740499497217560748,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,10151139797098616253,12991750526446086460,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10491131879124951129,5067849914700105401,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10491131879124951129,5067849914700105401,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6240,i,7250782517990760525,12705910722369892705,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,8885371766443515701,6150783459693615458,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2904,i,613538289177298420,6029926763301255528,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6572,i,1694230901179659055,12375709639758930641,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6864,i,7066557249334502344,11020023089839840042,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,17753712208271473664,11655029154103587104,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,8756705680986240408,3924157965285209268,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,9933698438619466117,11851672897434488786,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,5065944916816658438,2255580168554835992,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4788,i,12033515758194649320,8131332762550214488,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5356,i,9336506047355633256,14999972569176831499,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6100,i,10922564540056001470,231059062189991355,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4384,i,15443091174700737556,2753147735910101062,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,12650676262717319777,10534552105081111506,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5340,i,4991819921972631210,8307350043432527149,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=2572,i,2490033197586375854,15109330476208108003,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=2436,i,9514086889150502959,8615860580730644385,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7212,i,1196570229652966005,16635859186843685273,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,881457347835182180,13940257214668366505,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,3779986212702392111,1477238721684027259,262144 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:106⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,5508241946390143567,3940423477392545415,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7460,i,17327716220243913544,7043581704260478012,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,14876752172263896135,13883830466681320995,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,3649402644755769898,16986404345213671772,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:146⤵
-
-
C:\Users\Admin\Downloads\Minecraft Education Installer (1).exe"C:\Users\Admin\Downloads\Minecraft Education Installer (1).exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NBLGGH4R2R6?ocid=&referrer=psi7⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,5686011142774222966,5933901470785975678,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5392,i,4165181896639204666,13272001004952121826,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=4852,i,17836912510557054815,7112237738003566394,2097152 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10003257524430503308,12098682309326916819,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,17213254402086140245,13592165540930481128,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,255207973168233827,17443488232699399295,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,13405070383615315292,17002064461811559903,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,4397106338771297148,5508697902248562052,524288 --field-trial-handle=2592,i,8497508570844792826,1486623162780657048,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:146⤵
-
-
-
-
C:\Users\Admin\Downloads\Minecraft Education Preview Installer.exe"C:\Users\Admin\Downloads\Minecraft Education Preview Installer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9PK8J8RZ7XQC?ocid=&referrer=psi5⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6516,i,7110866541456272611,12475359731988644139,262144 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=4544,i,17679792669139529115,1804835229136383063,2097152 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14⤵
-
-
C:\Users\Admin\Downloads\Minecraft Education Preview Installer.exe"C:\Users\Admin\Downloads\Minecraft Education Preview Installer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9PK8J8RZ7XQC?ocid=&referrer=psi5⤵
-
-
-
C:\Users\Admin\Downloads\Minecraft Education Installer.exe"C:\Users\Admin\Downloads\Minecraft Education Installer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NBLGGH4R2R6?ocid=&referrer=psi5⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6676,i,6624008465927830236,12449232454753979208,524288 --field-trial-handle=1972,i,3104742854060888575,9423377962614989562,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:144⤵
-
-
-
-
C:\Windows\system32\msdt.exe"C:\Windows\system32\msdt.exe" -id AppsDiagnostic -ep CortanaSearch2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sfc.exe"C:\Windows\system32\sfc.exe" /scanfile=C:\Windows\system32\Qmgr.dll2⤵
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" sdshow bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\bitsadmin.exe"C:\Windows\system32\bitsadmin.exe" /reset /allusers2⤵
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" start bits2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start bits3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
BookmarkMergedSurfaceOrdering
f_000036
the-real-index
messages.json
craw_background.js
CURRENT
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe65c0bc.TMP
the-real-index
the-real-index~RFe6610a1.TMP
index
temp-index
the-real-index~RFe65d741.TMP
index.txt
index.txt
index.txt
index.txt~RFe65728c.TMP
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
56a024d0-1b2e-4dd4-b500-bdd9103753e3.tmp
settings.dat
settings.dat
LOG.old
MANIFEST-000001
f_00006a
f_00006b
f_00006c
f_00006d
f_00006e
f_00006f
f_000070
f_000072
f_000074
f_000075
f_000076
f_000077
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_00007e
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe669ded.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe667ac5.TMP
011c67e396f827d6_0
011c67e396f827d6_1
0377ae5b89aba911_0
0a5e766e47005690_0
0fcbcfcdd7633852_0
106c50e3fab11751_0
12ec1f0ba624d3e6_0
152af86d98108bac_0
1631251b034233de_0
18c7b1c15aecc4a8_0
1c71700ad32c3f09_0
222f9371e325cda1_0
253f4f4fd2a0107d_0
288d8708ab17f69c_0
2a3e55b2bb87013b_0
2b2f172845b92c74_0
2f73135c0a6b9b4d_0
34192a7864ec3421_0
380d60ba92eded25_0
3aeb8fdb64cf4a16_0
3c40a98e20b2bedc_0
3fb73fd6859c6429_0
41e337e3a554165a_0
432f2b8640acdb50_0
4ac91201d5a088aa_0
4ba14407ac8d06a0_0
52efed44d2719541_0
56cd88e58fd72e2b_0
575f435dfba98d34_0
598c9f92c8ab8acc_0
599e0d85aeb91072_0
5ab9f92edd24253c_0
5d9628610ff7825d_0
6ad13119c299c9a9_0
6f89ae06af792705_0
6fbe866b2ca3f589_0
76ef9b298c4e5889_0
7bedcade0083d2e1_0
7bedcade0083d2e1_1
7f38c4b221909c19_0
8974f973a413ae59_0
9a2f520bcf1ced67_0
a42f02fcc13c8a29_0
a7ea4caaa4364889_0
a9dc0af7392808c3_0
b367a8af401f4115_0
ba6063f66269eb89_0
be79b00f3951e101_0
c3d65bc3c72447ac_0
c41a4a2e87a4894f_0
c7aeb286e6491a8d_0
ca562a71b72cb0ec_0
cbecde8287f933a6_0
ce3211c76c4d8fa4_0
d6c3d007213256b2_0
dc02a617fa3d1ed0_0
df5fbe1f7f586ac6_0
e113c8a37f0530b7_0
e4d5966c49c2b8bc_0
e755f1608a82c845_0
ee654090529b00bf_0
f32a0af28bc51290_0
f87e75d32ac7eb02_0
fb83526e93ff9552_0
fbc9a19c92401bca_0
fcc59e7e28232f7d_0
the-real-index
the-real-index
the-real-index~RFe66a59d.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe677cd3.TMP
temp-index
the-real-index
the-real-index~RFe6783d8.TMP
98edb7bbe330b8cf_0
b821c907512c3901_0
caef21093c24064e_0
d423b9348c0f3f3f_0
eb3bb2d177606457_0
the-real-index
the-real-index
the-real-index
the-real-index~RFe6782bf.TMP
todelete_2193d9f3151d6572_0_2
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt.tmp
index.txt~RFe662c85.TMP
f1cdccba37924bda_0
f1cdccba37924bda_1
the-real-index
the-real-index~RFe6679da.TMP
OperationConfig
OperationConfig~RFe66fd24.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe673e53.TMP
e51d3f4ef39e9104ec54e50dda09696dc25e190990c201a202292cc0ce740397
metadata.json
metadata.json
metadata.json
metadata.json
db6fccdd-229d-4674-97e7-e75b941965c7.tmp
WPF15AB.tmp
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
TmpE933.tmp
messages.json
content_new.js
Microsoft.Services.Store.winmd
Minecraft Education Installer.exe
Minecraft Education Preview Installer.exe
desktop.ini
memory/696-17-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-11-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-2-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-3-0x00007FFC1E3DF000-0x00007FFC1E3E0000-memory.dmp
memory/696-7-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-1-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-6-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-10-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-9-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-8-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-19-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-12-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-5-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-18-0x00007FFC1E280000-0x00007FFC1E4E3000-memory.dmp
memory/696-15-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-13-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-14-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-4-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-0-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/696-16-0x00007FFBDE3C0000-0x00007FFBDE3D0000-memory.dmp
memory/1604-4597-0x0000022E1A670000-0x0000022E1A770000-memory.dmp
memory/1604-4393-0x0000022E1ACB0000-0x0000022E1ADB0000-memory.dmp
memory/1604-2664-0x0000022E176C0000-0x0000022E177C0000-memory.dmp
memory/1604-52-0x0000022E03A30000-0x0000022E03A50000-memory.dmp
memory/1604-53-0x0000022E13E90000-0x0000022E13F90000-memory.dmp
memory/1604-90-0x0000022E141D0000-0x0000022E141F0000-memory.dmp
memory/1604-61-0x0000022E03C90000-0x0000022E03CB0000-memory.dmp
memory/1604-5616-0x0000022E034C0000-0x0000022E035C0000-memory.dmp
memory/1604-2609-0x0000022E19890000-0x0000022E19990000-memory.dmp
memory/1604-43-0x0000022E001E0000-0x0000022E002E0000-memory.dmp
memory/1708-1566-0x000001EE00E20000-0x000001EE01348000-memory.dmp
memory/1708-1563-0x000001EE7D5E0000-0x000001EE7D5F2000-memory.dmp
memory/1708-1587-0x000001EE7D580000-0x000001EE7D588000-memory.dmp
memory/1708-1567-0x000001EE7E740000-0x000001EE7E77E000-memory.dmp
memory/1708-1577-0x000001EE7EA30000-0x000001EE7EBB8000-memory.dmp
memory/1708-1541-0x000001EE62E90000-0x000001EE62FEC000-memory.dmp
memory/1708-1568-0x000001EE7D540000-0x000001EE7D54E000-memory.dmp
memory/1708-1550-0x000001EE7E620000-0x000001EE7E6DA000-memory.dmp
memory/1708-1565-0x000001EE7E120000-0x000001EE7E146000-memory.dmp
memory/1708-1564-0x000001EE7E160000-0x000001EE7E19C000-memory.dmp
memory/1708-1578-0x000001EE7D560000-0x000001EE7D568000-memory.dmp
memory/1708-1551-0x000001EE7D530000-0x000001EE7D53A000-memory.dmp
memory/5284-697-0x000000000F6F0000-0x000000000F79E000-memory.dmp
memory/5284-185-0x000000000F6F0000-0x000000000F79E000-memory.dmp
memory/7224-5659-0x000001DDF8DF0000-0x000001DDF8E12000-memory.dmp
memory/7424-5787-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5794-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5781-0x000002D412F40000-0x000002D412F41000-memory.dmp
memory/7424-5783-0x000002D412F50000-0x000002D412F51000-memory.dmp
memory/7424-5782-0x000002D412F50000-0x000002D412F51000-memory.dmp
memory/7424-5784-0x000002D412F60000-0x000002D412F61000-memory.dmp
memory/7424-5786-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5785-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5742-0x000002D412BA0000-0x000002D412BB0000-memory.dmp
memory/7424-5788-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5789-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5790-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5792-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5791-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5793-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5777-0x000002D412F00000-0x000002D412F01000-memory.dmp
memory/7424-5795-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5796-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5797-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5798-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5799-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5800-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5801-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5802-0x000002D412F70000-0x000002D412F71000-memory.dmp
memory/7424-5803-0x000002D412F80000-0x000002D412F81000-memory.dmp
memory/7424-5804-0x000002D412F80000-0x000002D412F81000-memory.dmp
memory/7424-5805-0x000002D412F90000-0x000002D412F91000-memory.dmp
memory/7424-5807-0x000002D412FF0000-0x000002D412FF1000-memory.dmp
memory/7424-5806-0x000002D412FE0000-0x000002D412FE1000-memory.dmp
memory/7424-5779-0x000002D412F40000-0x000002D412F41000-memory.dmp
memory/7424-5758-0x000002D412CA0000-0x000002D412CB0000-memory.dmp