Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://www.upload.e...

windows10-2004-x64

10

Analysis

  • max time kernel
    297s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 11:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://www.upload.ee/files/16384710/Client.exe.html

Score
10/10
arrowratsvchost persistencerat

Malware Config

Extracted

Family

arrowrat

Botnet

svchost

C2

authority-amazon.gl.at.ply.gg:41414

Mutex

mNnfMgqNP

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 47 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.upload.ee/files/16384710/Client.exe.html
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:444
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab57746f8,0x7ffab5774708,0x7ffab5774718
      2⤵
        PID:4540
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        2⤵
          PID:2844
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4316
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
          2⤵
            PID:2004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
            2⤵
              PID:2044
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:4952
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
                2⤵
                  PID:3888
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
                  2⤵
                    PID:448
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
                    2⤵
                      PID:4404
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
                      2⤵
                        PID:1956
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                        2⤵
                          PID:3904
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                          2⤵
                            PID:5144
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                            2⤵
                              PID:5152
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
                              2⤵
                                PID:5232
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
                                2⤵
                                  PID:5524
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5540
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
                                  2⤵
                                    PID:5644
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6096 /prefetch:8
                                    2⤵
                                      PID:5840
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                                      2⤵
                                        PID:5848
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
                                        2⤵
                                          PID:5268
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7292 /prefetch:8
                                          2⤵
                                            PID:4036
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7440 /prefetch:8
                                            2⤵
                                              PID:5516
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5320
                                            • C:\Users\Admin\Downloads\Client.exe
                                              "C:\Users\Admin\Downloads\Client.exe"
                                              2⤵
                                              • Modifies WinLogon for persistence
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1148
                                              • C:\Windows\explorer.exe
                                                "C:\Windows\explorer.exe"
                                                3⤵
                                                • Modifies registry class
                                                PID:3988
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                3⤵
                                                  PID:228
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                  3⤵
                                                    PID:1544
                                                  • C:\Windows\System32\ComputerDefaults.exe
                                                    "C:\Windows\System32\ComputerDefaults.exe"
                                                    3⤵
                                                      PID:5816
                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
                                                        "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost\svchost '
                                                        4⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6396
                                                  • C:\Users\Admin\Downloads\Client.exe
                                                    "C:\Users\Admin\Downloads\Client.exe"
                                                    2⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5672
                                                    • C:\Windows\explorer.exe
                                                      "C:\Windows\explorer.exe"
                                                      3⤵
                                                      • Modifies Installed Components in the registry
                                                      • Enumerates connected drives
                                                      • Checks SCSI registry key(s)
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4176
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                      3⤵
                                                        PID:3320
                                                      • C:\Windows\System32\ComputerDefaults.exe
                                                        "C:\Windows\System32\ComputerDefaults.exe"
                                                        3⤵
                                                          PID:6068
                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
                                                            "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost\svchost '
                                                            4⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:6424
                                                      • C:\Users\Admin\Downloads\Client.exe
                                                        "C:\Users\Admin\Downloads\Client.exe"
                                                        2⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:6004
                                                        • C:\Windows\explorer.exe
                                                          "C:\Windows\explorer.exe"
                                                          3⤵
                                                          • Modifies registry class
                                                          PID:6028
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                          3⤵
                                                            PID:5252
                                                          • C:\Windows\System32\ComputerDefaults.exe
                                                            "C:\Windows\System32\ComputerDefaults.exe"
                                                            3⤵
                                                              PID:4940
                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
                                                                "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost\svchost '
                                                                4⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:6408
                                                          • C:\Users\Admin\Downloads\Client.exe
                                                            "C:\Users\Admin\Downloads\Client.exe"
                                                            2⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4496
                                                            • C:\Windows\explorer.exe
                                                              "C:\Windows\explorer.exe"
                                                              3⤵
                                                              • Modifies registry class
                                                              PID:4740
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                              3⤵
                                                                PID:5152
                                                              • C:\Windows\System32\ComputerDefaults.exe
                                                                "C:\Windows\System32\ComputerDefaults.exe"
                                                                3⤵
                                                                  PID:6284
                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
                                                                    "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost\svchost '
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:6588
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
                                                                2⤵
                                                                  PID:6672
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1
                                                                  2⤵
                                                                    PID:6632
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
                                                                    2⤵
                                                                      PID:6592
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
                                                                      2⤵
                                                                        PID:5476
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:2
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3760
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1723884495220038663,7537918139052962438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
                                                                        2⤵
                                                                          PID:6836
                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                        1⤵
                                                                          PID:1148
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:4396
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:6336
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2068
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:792
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:7076
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5344
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:6660
                                                                          • C:\Users\Admin\Downloads\Client.exe
                                                                            "C:\Users\Admin\Downloads\Client.exe"
                                                                            1⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:6676
                                                                            • C:\Windows\explorer.exe
                                                                              "C:\Windows\explorer.exe"
                                                                              2⤵
                                                                                PID:752
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                                                2⤵
                                                                                  PID:6168
                                                                                • C:\Windows\System32\ComputerDefaults.exe
                                                                                  "C:\Windows\System32\ComputerDefaults.exe"
                                                                                  2⤵
                                                                                    PID:4500
                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
                                                                                      "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost\svchost '
                                                                                      3⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:6584
                                                                                • C:\Users\Admin\Downloads\Client.exe
                                                                                  "C:\Users\Admin\Downloads\Client.exe"
                                                                                  1⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:6908
                                                                                  • C:\Windows\explorer.exe
                                                                                    "C:\Windows\explorer.exe"
                                                                                    2⤵
                                                                                      PID:6832
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                                                      2⤵
                                                                                        PID:5960
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" svchost authority-amazon.gl.at.ply.gg 41414 mNnfMgqNP
                                                                                        2⤵
                                                                                          PID:1400
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c taskkill /F /IM edge.exe
                                                                                            3⤵
                                                                                              PID:7020
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /F /IM edge.exe
                                                                                                4⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4312
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c taskkill /F /IM edge.exe
                                                                                              3⤵
                                                                                                PID:6208
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  taskkill /F /IM edge.exe
                                                                                                  4⤵
                                                                                                  • Kills process with taskkill
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:736
                                                                                            • C:\Windows\System32\ComputerDefaults.exe
                                                                                              "C:\Windows\System32\ComputerDefaults.exe"
                                                                                              2⤵
                                                                                                PID:4940
                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
                                                                                                  "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost\svchost '
                                                                                                  3⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:6152
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              PID:2952

                                                                                            Network

                                                                                            MITRE ATT&CK Matrix ATT&CK v13

                                                                                            Initial Access

                                                                                            Execution

                                                                                            Persistence

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Winlogon Helper DLL

                                                                                            1
                                                                                            T1547.004

                                                                                            Privilege Escalation

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Winlogon Helper DLL

                                                                                            1
                                                                                            T1547.004

                                                                                            Defense Evasion

                                                                                            Modify Registry

                                                                                            3
                                                                                            T1112

                                                                                            Credential Access

                                                                                            Discovery

                                                                                            Query Registry

                                                                                            5
                                                                                            T1012

                                                                                            System Information Discovery

                                                                                            5
                                                                                            T1082

                                                                                            Peripheral Device Discovery

                                                                                            2
                                                                                            T1120

                                                                                            Lateral Movement

                                                                                            Collection

                                                                                            Exfiltration

                                                                                            Command and Control

                                                                                            Impact

                                                                                            Resource Development

                                                                                            Reconnaissance

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              d85ba6ff808d9e5444a4b369f5bc2730

                                                                                              SHA1

                                                                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                              SHA256

                                                                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                              SHA512

                                                                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                              Filesize

                                                                                              152B

                                                                                              MD5

                                                                                              47b2c6613360b818825d076d14c051f7

                                                                                              SHA1

                                                                                              7df7304568313a06540f490bf3305cb89bc03e5c

                                                                                              SHA256

                                                                                              47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

                                                                                              SHA512

                                                                                              08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                              Filesize

                                                                                              152B

                                                                                              MD5

                                                                                              e0811105475d528ab174dfdb69f935f3

                                                                                              SHA1

                                                                                              dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

                                                                                              SHA256

                                                                                              c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

                                                                                              SHA512

                                                                                              8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                              Filesize

                                                                                              288B

                                                                                              MD5

                                                                                              71b6cd5051b3440b7096010cf972e1ef

                                                                                              SHA1

                                                                                              d9c09e41c4f979b6ced2e2d7338b00e65df05ef6

                                                                                              SHA256

                                                                                              7c09ad999cf33981a6e82c4a39a428557a291152aa3b1e8e8a1d94ef1df1f3b9

                                                                                              SHA512

                                                                                              989a3c104a02c46cc394a847c89497d3ba49be4130a1fbb525301ba6e0e7be962ac4ef69f2223595c3ed993da590da8e977d5fd9f6a5d2f78aacd719b58caa1a

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                              Filesize

                                                                                              3KB

                                                                                              MD5

                                                                                              09856c32e4338f96f804792116032e45

                                                                                              SHA1

                                                                                              f80be633685de431377c79bd34cf811755591cf5

                                                                                              SHA256

                                                                                              ac73724b4fb6140b9f82623c763b3e34916c9871fd07e7799772f5151419358a

                                                                                              SHA512

                                                                                              9406d3d6a2b11a080a7a778cb97a0cd36cdd27162ee94b8171568db91946e7c5a68fa6007786b83324b38294fb5a828956a558bc32d5aade29eca30dab81e916

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              48d8a3ea2e51a1349fc23a1e409d88d6

                                                                                              SHA1

                                                                                              2f1457ddaf107f8ea487df8e2311934e2d744e6a

                                                                                              SHA256

                                                                                              8f59ed66e77dd30b35034d474a068f0f9b6e9ff480bde90d5f7638dfa17340e7

                                                                                              SHA512

                                                                                              00fe0f49228430c691eaa009b3644faab72f0a4bb26195c5585098408a0cea0af894489f1622ff606de895740f7ada301eae387c0704df0e14becba6bbb3f8a4

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              6b6c3acb75eb6081d906d4616c8f720f

                                                                                              SHA1

                                                                                              4aadcf1336adcfc90abbaa213040b2c8292f3f8b

                                                                                              SHA256

                                                                                              10dc0724eaed4de973c8eddf744bd0df6945dabf5d7f6cd4da4fa8b62e9a51b9

                                                                                              SHA512

                                                                                              2fd5fec44d6bca2a0c9219df570c5a39c83cb5799ea1164dd6381285a469ab2ffa8eb6597f38031526b17e2d0c69ab42be9c5777531f2a19f42091efe11ee532

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              ee54eb67096e594530be300a01eea7ef

                                                                                              SHA1

                                                                                              b9538d3bfff0dd285782b59f144d89bdec103b66

                                                                                              SHA256

                                                                                              744d2b798903e3ac4368cdbc05f4c9ded6b13eb7372b83dd1700c5a118fab35b

                                                                                              SHA512

                                                                                              eba0fdc598b41f7c108eb810c2d76c47626486f493bd4d1226aa9a83d653e92b8ea3cd77f89c013447fd1315a4fb516c9e895b860f28b142d8c974c01269c3c4

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              0ac56cddb337151de54aad732c21df96

                                                                                              SHA1

                                                                                              7b599929ba30b7a18acaac6c9ce68805d572b31d

                                                                                              SHA256

                                                                                              9309ef5354c5f86c811704a6048a4620ee50ff65ccdc81685b86cb51e8cb3b05

                                                                                              SHA512

                                                                                              5ec59e4979bf30e5c2b0c15b341b3208f8349551d50ddeebb60b3e1897c0509763b9795616e95eb9c5e58ff628542b5bf34505f59f5aa0a4cd54b8155875b6de

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              0965b841722f237a2b4a00d059117b53

                                                                                              SHA1

                                                                                              55eb2c38e87423be9f98f2448d59217ae4a9a61b

                                                                                              SHA256

                                                                                              ba9657c58cd5017c4c303d8346d503fea4a702d8f4e99142c3320f7e7ba08c78

                                                                                              SHA512

                                                                                              f3c56b342fbd88be60882a85a9bfac06ae016cda26ee8d54502fde3ef422a51ae8c60c34b0543dd910dbd1082d3263a908533188b31865c10764ab3e4d98c9ec

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                              Filesize

                                                                                              16B

                                                                                              MD5

                                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                                              SHA1

                                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                              SHA256

                                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                              SHA512

                                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              Filesize

                                                                                              11KB

                                                                                              MD5

                                                                                              00a00fcccc8898e54266200cd1b51207

                                                                                              SHA1

                                                                                              4c9409d56e675315d17e0ba79d534de3605a1e44

                                                                                              SHA256

                                                                                              770245ef8fc3963ba1accb1f89776b8c1c9b4c42c901dc354a768753916d3143

                                                                                              SHA512

                                                                                              e57017a7c231bf678f56f1d6a007f40623f0f36128ef99a8cfb8c48cd4a5d4bbdbf8cc9489359d7bc626e0fd93738b1775f6e87cb187dbb0baa79a74f3c4f6f9

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              Filesize

                                                                                              11KB

                                                                                              MD5

                                                                                              adb96d86358653a3f3e79c2936c4e2e4

                                                                                              SHA1

                                                                                              de29219e903e7f10d29fa2e7c523af7ffb47f1ef

                                                                                              SHA256

                                                                                              e52076785d654eaedb99da7029cf43402330c92a0be3fe1497bf585333884d8a

                                                                                              SHA512

                                                                                              9fb5de9c4a43bd42cb82d9eddab3d74721c65a4c370dfd39d27dc43d8120c482f4f5e4222ba08225b18267c2460423b862b40254764c0d3b0d5cf154bbc2a569

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                              Filesize

                                                                                              11KB

                                                                                              MD5

                                                                                              cc4cd9545f38d252735c1d99fbbe61f2

                                                                                              SHA1

                                                                                              20fce28ae11fc8cf7483f7ccd1042c6b96f450f2

                                                                                              SHA256

                                                                                              4e4bf5d6e281ce000824192e57864b12e4f6613224aa74ec8c549ca70a26f184

                                                                                              SHA512

                                                                                              fc6f15c2ac910d6529802f8bb75342d4932078363712a60d8aaa623314bd7f4512e48e712ce481938b5fdc575ece5f1d1f213da4bbbaa2b5be8760a918a913ee

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              Filesize

                                                                                              944B

                                                                                              MD5

                                                                                              aaaac7c68d2b7997ed502c26fd9f65c2

                                                                                              SHA1

                                                                                              7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                                                                              SHA256

                                                                                              8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                                                                              SHA512

                                                                                              c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              Filesize

                                                                                              944B

                                                                                              MD5

                                                                                              3a6bad9528f8e23fb5c77fbd81fa28e8

                                                                                              SHA1

                                                                                              f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                                                              SHA256

                                                                                              986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                                                              SHA512

                                                                                              846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              Filesize

                                                                                              944B

                                                                                              MD5

                                                                                              60945d1a2e48da37d4ce8d9c56b6845a

                                                                                              SHA1

                                                                                              83e80a6acbeb44b68b0da00b139471f428a9d6c1

                                                                                              SHA256

                                                                                              314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

                                                                                              SHA512

                                                                                              5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
                                                                                              Filesize

                                                                                              36KB

                                                                                              MD5

                                                                                              8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                                              SHA1

                                                                                              231237a501b9433c292991e4ec200b25c1589050

                                                                                              SHA256

                                                                                              813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                                              SHA512

                                                                                              1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
                                                                                              Filesize

                                                                                              36KB

                                                                                              MD5

                                                                                              fb5f8866e1f4c9c1c7f4d377934ff4b2

                                                                                              SHA1

                                                                                              d0a329e387fb7bcba205364938417a67dbb4118a

                                                                                              SHA256

                                                                                              1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

                                                                                              SHA512

                                                                                              0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133548037749099144.txt
                                                                                              Filesize

                                                                                              75KB

                                                                                              MD5

                                                                                              395033c7abb82b9899d9c830a8763570

                                                                                              SHA1

                                                                                              c17951eddeeb39df4346441d1a7dca6508e217dc

                                                                                              SHA256

                                                                                              920fd4594a30beac12a6d4b205dbff6b4f34ecebbc1f9d280277f65c32816c93

                                                                                              SHA512

                                                                                              109eb2b1f6908219d229f59ddab1dfb3cc25c2f820bbe52010e4e4cdb32513bc20fec74eaa63bf0e24523c2d1a1730d3bcf1d53b150c47c5064cdb1e1a297f9a

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\39XIXV5T\microsoft.windows[1].xml
                                                                                              Filesize

                                                                                              96B

                                                                                              MD5

                                                                                              29e3c94dfa03b794f03e17d8b45295d9

                                                                                              SHA1

                                                                                              1a598a72d3d486f77e861f98abcd2f4a8e936365

                                                                                              SHA256

                                                                                              7ff0263086f28cc1d842d07a23128b955780d3c8b85b130228c7f65ce2b4262a

                                                                                              SHA512

                                                                                              e2180d73f45da32ac4fb355546103496d73cdf7cb966c60f6a414bc7052e46431177e9009bdfd730d2fe6955b986392720fe3bdc8afbc0388f1b70e438a4ef9c

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Temp\TMP_pass
                                                                                              Filesize

                                                                                              46KB

                                                                                              MD5

                                                                                              02d2c46697e3714e49f46b680b9a6b83

                                                                                              SHA1

                                                                                              84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                              SHA256

                                                                                              522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                              SHA512

                                                                                              60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pqsoza4i.avy.ps1
                                                                                              Filesize

                                                                                              60B

                                                                                              MD5

                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                              SHA1

                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                              SHA256

                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                              SHA512

                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              2b10724e1f0b93c6650ff2d46393be49

                                                                                              SHA1

                                                                                              3815dd98ce219d1419aa8c4dfd0200ec34dea174

                                                                                              SHA256

                                                                                              61bce793fe8fa071f9177f69af170686fc55ed03697cfe0c02f12d9e392e4998

                                                                                              SHA512

                                                                                              61249dedf277b13c5a0d387e50a8eeda3dd9e07bed21d1a7b690147ed9926d8e40ef46ea99484ea52ce53b8a327f9392e35bcaa9739c6f5ba50780f3b7aebcb5

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              515b42e4d827d0c72a6b39fbefa410a8

                                                                                              SHA1

                                                                                              adf295e31b1a2327cb7f1117661950382610d9f5

                                                                                              SHA256

                                                                                              8f46acf55f37e95d1955c9de29ce59b5cf81971c659f3fc7985faf14a52d547f

                                                                                              SHA512

                                                                                              f14c6f5b0969b9a31ceb567b8c33e4ef2882b23183f4a751b12dcd687f3a6543ef0feff20a615f35dc826e0cc734b42752bd52c7653771c775b4d96875a0a6cd

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              f839ba8e205ec80c24de46308ed0eb05

                                                                                              SHA1

                                                                                              5523adad4763a169b2dd0dc0f12c9fe17cc5f291

                                                                                              SHA256

                                                                                              b86fe25bc2a8f3bb04e73b2ed91ff0c2d66b4d49e76e899eac5051fadfb91f06

                                                                                              SHA512

                                                                                              197023a8b3c34bf431b83d2d415694f5ac050d363e8a8ec0f4105d5c9755cd1a626e744f8091e2172e40877ae2a9c1fd39cd12f207a8438f72bae28baa9d4c88

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              8b8f43e9b09326858130a8a774ac1c68

                                                                                              SHA1

                                                                                              7fcc46533e09ab77a2b1738810f59a98ef7b8894

                                                                                              SHA256

                                                                                              222a23bb1ddb82cf0f2739cc39d2e38297ee45d37484ef1530bc3717dcab7c3f

                                                                                              SHA512

                                                                                              f9bece99aec03291550750bcf0d740fedb2044cf2f4b331653d602b2bb1fd70ee9810190bfd0a63422b953760b85a984355925aed7c8caba70d31f5666a310c5

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              acd6dde4df4f3d0a631b94726ee1a5c8

                                                                                              SHA1

                                                                                              360d32946569bb2c687a3ffe0897af9dff3fb92e

                                                                                              SHA256

                                                                                              77c3173a83899e1086d8687a5e32d9ee2d117f4773b60af6d03d479e5ba3e03d

                                                                                              SHA512

                                                                                              ece0c92482780a0a2b8c60ea806eece308e061bbe8fff47738e724f320c67037bc076ecc28b961f3623f0702ae7c60295525c62b63ed1460a6fb70b57845bd48

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              6KB

                                                                                              MD5

                                                                                              d3f504bdef0ddf7a11e612eb6e69ab52

                                                                                              SHA1

                                                                                              71a58d3ea1eea59a5e68dd9ece3e66fd686f17c0

                                                                                              SHA256

                                                                                              c0f6ab86239ac5fe9f247bff938f0a5fb12dda6f1781b64cd422ce226d1289cb

                                                                                              SHA512

                                                                                              98791f4f06036718aaa837986014389c60616818a853fdfdbb48f1c0327f5513499f61622574b2b00c41afac6ee9f9e81fb02f374c8ca6596ceac88f50235d8d

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Roaming\temp0923
                                                                                              Filesize

                                                                                              10B

                                                                                              MD5

                                                                                              50a94ce3d6ffcddbe2241f83604513cd

                                                                                              SHA1

                                                                                              d28a1b743c748ed01e0ead41966e410cecb3179c

                                                                                              SHA256

                                                                                              f37d873f04587b5314f3c405c12404fef345ea784532d695262d151a0f40e6ac

                                                                                              SHA512

                                                                                              dd8295302ca78651520f58e65601e1221e30a8178c5a0b81cd26507af0a9db174fcb4d68c7d6eae19ebdae948ca1401065f674d62f51de287fc49c0093a965ba

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\Downloads\e802c0a4-30c7-42f4-9025-b5a7d1880652.tmp
                                                                                              Filesize

                                                                                              158KB

                                                                                              MD5

                                                                                              6337fcb738e463b8b757bc38683766cb

                                                                                              SHA1

                                                                                              b10fd13b5d2ef88c195e46f1d3d1dfaf0afad9f3

                                                                                              SHA256

                                                                                              f4e857acb21f5b7e0a543f87962c17da9f070d39eeead4b244d41a7023edac92

                                                                                              SHA512

                                                                                              d4f9a863ae6c5475e5e17ad05868db1971b5488cf720359ce339398b26de59342b2ce543477d372a92ad8244f7dd2894498b9882ec07c73e0b75c0bdcb68140b

                                                                                              Download Submit
                                                                                            • \??\pipe\LOCAL\crashpad_444_CMFWPWITRSPBBCZE
                                                                                              MD5

                                                                                              d41d8cd98f00b204e9800998ecf8427e

                                                                                              SHA1

                                                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                              SHA256

                                                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                              SHA512

                                                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                              Download Submit
                                                                                            • memory/792-309-0x000002CB4B620000-0x000002CB4B640000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/792-314-0x000002CB4B9F0000-0x000002CB4BA10000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/792-311-0x000002CB4B5E0000-0x000002CB4B600000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1148-151-0x0000024BE4F10000-0x0000024BE4F20000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/1148-130-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/1148-128-0x0000024BCA950000-0x0000024BCA97E000-memory.dmp
                                                                                              Filesize

                                                                                              184KB

                                                                                              Download
                                                                                            • memory/1148-366-0x0000024BE4F10000-0x0000024BE4F20000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/1148-169-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/1400-459-0x00000000051F0000-0x0000000005200000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/1400-506-0x0000000075420000-0x0000000075BD0000-memory.dmp
                                                                                              Filesize

                                                                                              7.7MB

                                                                                              Download
                                                                                            • memory/1400-530-0x00000000051F0000-0x0000000005200000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/1400-458-0x0000000075420000-0x0000000075BD0000-memory.dmp
                                                                                              Filesize

                                                                                              7.7MB

                                                                                              Download
                                                                                            • memory/1544-131-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                              Filesize

                                                                                              96KB

                                                                                              Download
                                                                                            • memory/2068-281-0x0000019CC3A50000-0x0000019CC3A70000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2068-279-0x0000019CC3A90000-0x0000019CC3AB0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2068-284-0x0000019CC3E60000-0x0000019CC3E80000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4176-267-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/4496-397-0x00000202F81B0000-0x00000202F81C0000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/4496-323-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/4496-144-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/5152-392-0x0000000075420000-0x0000000075BD0000-memory.dmp
                                                                                              Filesize

                                                                                              7.7MB

                                                                                              Download
                                                                                            • memory/5152-153-0x0000000005ED0000-0x0000000006474000-memory.dmp
                                                                                              Filesize

                                                                                              5.6MB

                                                                                              Download
                                                                                            • memory/5152-157-0x0000000006680000-0x00000000066D0000-memory.dmp
                                                                                              Filesize

                                                                                              320KB

                                                                                              Download
                                                                                            • memory/5152-154-0x0000000005E10000-0x0000000005E76000-memory.dmp
                                                                                              Filesize

                                                                                              408KB

                                                                                              Download
                                                                                            • memory/5152-351-0x0000000005810000-0x0000000005820000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/5152-150-0x0000000005810000-0x0000000005820000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/5152-149-0x0000000005660000-0x00000000056FC000-memory.dmp
                                                                                              Filesize

                                                                                              624KB

                                                                                              Download
                                                                                            • memory/5152-350-0x0000000075420000-0x0000000075BD0000-memory.dmp
                                                                                              Filesize

                                                                                              7.7MB

                                                                                              Download
                                                                                            • memory/5152-148-0x0000000075420000-0x0000000075BD0000-memory.dmp
                                                                                              Filesize

                                                                                              7.7MB

                                                                                              Download
                                                                                            • memory/5152-147-0x00000000055C0000-0x0000000005652000-memory.dmp
                                                                                              Filesize

                                                                                              584KB

                                                                                              Download
                                                                                            • memory/5344-374-0x0000026E54300000-0x0000026E54320000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/5344-376-0x0000026E542C0000-0x0000026E542E0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/5344-380-0x0000026E54920000-0x0000026E54940000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/5672-137-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/5672-387-0x000002A129040000-0x000002A129050000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/5672-237-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/5672-152-0x000002A129040000-0x000002A129050000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6004-266-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6004-389-0x0000028BC82E0000-0x0000028BC82F0000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6004-142-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6152-485-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6152-481-0x0000023228A00000-0x0000023228A10000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6152-471-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6168-396-0x0000000075420000-0x0000000075BD0000-memory.dmp
                                                                                              Filesize

                                                                                              7.7MB

                                                                                              Download
                                                                                            • memory/6168-452-0x0000000075420000-0x0000000075BD0000-memory.dmp
                                                                                              Filesize

                                                                                              7.7MB

                                                                                              Download
                                                                                            • memory/6396-234-0x000001FD772E0000-0x000001FD772F0000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6396-247-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6396-256-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6408-197-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6408-258-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6408-198-0x000002E21EAC0000-0x000002E21EAD0000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6424-233-0x000002DE6A570000-0x000002DE6A580000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6424-257-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6424-214-0x000002DE6A570000-0x000002DE6A580000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6424-175-0x000002DE6A500000-0x000002DE6A522000-memory.dmp
                                                                                              Filesize

                                                                                              136KB

                                                                                              Download
                                                                                            • memory/6424-204-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6584-435-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6584-440-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6584-436-0x0000024A9DFE0000-0x0000024A9DFF0000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6584-437-0x0000024A9DFE0000-0x0000024A9DFF0000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6588-235-0x000001B6C0260000-0x000001B6C0270000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6588-236-0x000001B6C0260000-0x000001B6C0270000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6588-248-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6588-261-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6660-408-0x0000021A5F670000-0x0000021A5F690000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/6660-406-0x0000021A5F1B0000-0x0000021A5F1D0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/6660-404-0x0000021A5F1F0000-0x0000021A5F210000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/6676-454-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6676-391-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6676-470-0x00000163B4010000-0x00000163B4020000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6676-419-0x00000163B4010000-0x00000163B4020000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6908-457-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6908-533-0x0000027426480000-0x0000027426490000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/6908-505-0x00007FFAA24D0000-0x00007FFAA2F91000-memory.dmp
                                                                                              Filesize

                                                                                              10.8MB

                                                                                              Download
                                                                                            • memory/6908-483-0x0000027426480000-0x0000027426490000-memory.dmp
                                                                                              Filesize

                                                                                              64KB

                                                                                              Download
                                                                                            • memory/7076-349-0x0000015896CE0000-0x0000015896D00000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/7076-354-0x00000160982C0000-0x00000160982E0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/7076-353-0x0000015896CA0000-0x0000015896CC0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download