remcos | 4ce4fd04bd63cd1196883abe8d581b987fc10a52215515d6f040128a523324aa

Analysis

max time kernel
153s
max time network
155s
platform
windows10_x64
resource
win10-en
submitted
20-09-2021 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
Size

1.6MB
MD5

8b7fed1914705666e4826519ebf2ebe7
SHA1

7916166229867d620b4b07a359d0bf92e6574b47
SHA256

4ccfbfb6751aca04fdefe4f96f95a322ac9684d62dd79c5f7d142c24f30eb5e8
SHA512

e602fd1acd3be2513d63e6335c564b17232ac9396d82818868e84534bc09ba57a8ce71db90cbe307bffb2cd13acaca580eaa59f7ea56f3b1d3494c56248ca1e1

Score

10^/10

remcos rdcrd microsoft evasion persistence phishing rat trojan

Malware Config

Extracted

Family

remcos

Version

3.2.1 Pro

Botnet

rdcrd

103.114.104.136:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Vlc.exe
copy_folder
VLC
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
system3
keylog_path
%AppData%
mouse_option
false
mutex
system32-AW6YV1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
system32
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 3 IoCs

Processes:

Vlc.exeVlc.exeVlc.exe

pid process

4128 Vlc.exe
4560 Vlc.exe
2824 Vlc.exe
Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

5012 WScript.exe

pid	process
4128	Vlc.exe
4560	Vlc.exe
2824	Vlc.exe

pid	process
5012	WScript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AW QUOTE 6677 HQ1-Scan-068703_PDF.exeVlc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\VLC\\Vlc.exe\""	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\VLC\\Vlc.exe\""	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\VLC\\Vlc.exe\""	Vlc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Vlc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\VLC\\Vlc.exe\""	Vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 3 IoCs

Processes:

AW QUOTE 6677 HQ1-Scan-068703_PDF.exe

description	ioc	process
File created	C:\Windows\SysWOW64\VLC\Vlc.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
File opened for modification	C:\Windows\SysWOW64\VLC\Vlc.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
File opened for modification	C:\Windows\SysWOW64\VLC	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

AW QUOTE 6677 HQ1-Scan-068703_PDF.exeVlc.exeVlc.exe

description	pid	process	target process
PID 4652 set thread context of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4128 set thread context of 2824	4128	Vlc.exe	Vlc.exe
PID 2824 set thread context of 4584	2824	Vlc.exe	svchost.exe
PID 2824 set thread context of 5008	2824	Vlc.exe	svchost.exe
PID 2824 set thread context of 2312	2824	Vlc.exe	svchost.exe
PID 2824 set thread context of 3060	2824	Vlc.exe	svchost.exe
PID 2824 set thread context of 5172	2824	Vlc.exe	svchost.exe

Drops file in Windows directory 13 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4808 schtasks.exe
4436 schtasks.exe

pid	process
4808	schtasks.exe
4436	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3178b2a3f6add701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{AFB6F3F1-13C2-4AB9-8289-F710D87FE62A} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{B1148EEE-8F8A-4BBB-97FF-F6DAAD163C87}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = b9d9ec28329fd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f939c4b1f6add701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

5000 reg.exe
4568 reg.exe

pid	process
5000	reg.exe
4568	reg.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

AW QUOTE 6677 HQ1-Scan-068703_PDF.exeVlc.exe

pid	process
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
4128	Vlc.exe
4128	Vlc.exe
4128	Vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Vlc.exe

pid process

2824 Vlc.exe

Suspicious behavior: MapViewOfSection 14 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid	process
3064	MicrosoftEdgeCP.exe
3064	MicrosoftEdgeCP.exe
3064	MicrosoftEdgeCP.exe
3064	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

AW QUOTE 6677 HQ1-Scan-068703_PDF.exeVlc.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
Token: SeDebugPrivilege	4128	Vlc.exe
Token: SeDebugPrivilege	1340	MicrosoftEdge.exe
Token: SeDebugPrivilege	1340	MicrosoftEdge.exe
Token: SeDebugPrivilege	1340	MicrosoftEdge.exe
Token: SeDebugPrivilege	1340	MicrosoftEdge.exe
Token: SeDebugPrivilege	2612	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2612	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2612	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2612	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1340	MicrosoftEdge.exe
Token: SeDebugPrivilege	4052	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4052	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

Vlc.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
2824	Vlc.exe
1340	MicrosoftEdge.exe
3064	MicrosoftEdgeCP.exe
3064	MicrosoftEdgeCP.exe
3548	MicrosoftEdge.exe
4612	MicrosoftEdgeCP.exe
4612	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AW QUOTE 6677 HQ1-Scan-068703_PDF.exeAW QUOTE 6677 HQ1-Scan-068703_PDF.execmd.exeWScript.execmd.exeVlc.exeVlc.exe

description	pid	process	target process
PID 4652 wrote to memory of 4808	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	schtasks.exe
PID 4652 wrote to memory of 4808	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	schtasks.exe
PID 4652 wrote to memory of 4808	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	schtasks.exe
PID 4652 wrote to memory of 4868	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4868	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4868	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4876	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4876	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4876	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4884	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4884	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4884	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4892	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4892	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4892	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4652 wrote to memory of 4900	4652	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
PID 4900 wrote to memory of 4936	4900	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	cmd.exe
PID 4900 wrote to memory of 4936	4900	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	cmd.exe
PID 4900 wrote to memory of 4936	4900	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	cmd.exe
PID 4936 wrote to memory of 5000	4936	cmd.exe	reg.exe
PID 4936 wrote to memory of 5000	4936	cmd.exe	reg.exe
PID 4936 wrote to memory of 5000	4936	cmd.exe	reg.exe
PID 4900 wrote to memory of 5012	4900	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	WScript.exe
PID 4900 wrote to memory of 5012	4900	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	WScript.exe
PID 4900 wrote to memory of 5012	4900	AW QUOTE 6677 HQ1-Scan-068703_PDF.exe	WScript.exe
PID 5012 wrote to memory of 5080	5012	WScript.exe	cmd.exe
PID 5012 wrote to memory of 5080	5012	WScript.exe	cmd.exe
PID 5012 wrote to memory of 5080	5012	WScript.exe	cmd.exe
PID 5080 wrote to memory of 4128	5080	cmd.exe	Vlc.exe
PID 5080 wrote to memory of 4128	5080	cmd.exe	Vlc.exe
PID 5080 wrote to memory of 4128	5080	cmd.exe	Vlc.exe
PID 4128 wrote to memory of 4436	4128	Vlc.exe	schtasks.exe
PID 4128 wrote to memory of 4436	4128	Vlc.exe	schtasks.exe
PID 4128 wrote to memory of 4436	4128	Vlc.exe	schtasks.exe
PID 4128 wrote to memory of 4560	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 4560	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 4560	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 4128 wrote to memory of 2824	4128	Vlc.exe	Vlc.exe
PID 2824 wrote to memory of 4632	2824	Vlc.exe	cmd.exe
PID 2824 wrote to memory of 4632	2824	Vlc.exe	cmd.exe
PID 2824 wrote to memory of 4632	2824	Vlc.exe	cmd.exe
PID 2824 wrote to memory of 2644	2824	Vlc.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\AW QUOTE 6677 HQ1-Scan-068703_PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WHQGmSHSPvC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA7D4.tmp"
2⤵
- Creates scheduled task(s)
PID:4808

C:\Users\Admin\AppData\Local\Temp\AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
"{path}"
2⤵
PID:4868

C:\Users\Admin\AppData\Local\Temp\AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
"{path}"
2⤵
PID:4876

C:\Users\Admin\AppData\Local\Temp\AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
"{path}"
2⤵
PID:4884

C:\Users\Admin\AppData\Local\Temp\AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
"{path}"
2⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\AW QUOTE 6677 HQ1-Scan-068703_PDF.exe
"{path}"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
- Modifies registry key
PID:5000

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\VLC\Vlc.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\VLC\Vlc.exe
C:\Windows\SysWOW64\VLC\Vlc.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WHQGmSHSPvC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E62.tmp"
6⤵
- Creates scheduled task(s)
PID:4436

C:\Windows\SysWOW64\VLC\Vlc.exe
"{path}"
6⤵
- Executes dropped EXE
PID:4560

C:\Windows\SysWOW64\VLC\Vlc.exe
"{path}"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
7⤵
PID:4632

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
8⤵
- Modifies registry key
PID:4568

\??\c:\program files\internet explorer\iexplore.exe
"c:\program files\internet explorer\iexplore.exe"
7⤵
PID:2644

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:4584

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:5008

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:2312

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:3060

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:5172

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3548

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4316

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:2512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1844

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1216

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\50CVNBL2\docons.97a9e7db[1].woff2
MD5
5d062f872c1600833f39feb797a9e7db

SHA1
3fef40e5e5a99058821699be07e35a4328e255c4

SHA256
78dbf0f234ec92b20a4354ff1391709f63ba3dc973f14b0e7e3fd52f12a10a4c

SHA512
7fac8479c7b7a1fb954c1ac311b2f4a7019f8bfb5c601f099a562de7af777b5e14ec3816b9425a0bf07250a12adf811a0bb700e0d1f37d9f9f3c3d69576aac45

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\50CVNBL2\install-3-5[1].png
MD5
f6ec97c43480d41695065ad55a97b382

SHA1
d9c3d0895a5ed1a3951b8774b519b8217f0a54c5

SHA256
07a599fab1e66babc430e5fed3029f25ff3f4ea2dd0ec8968ffba71ef1872f68

SHA512
22462763178409d60609761a2af734f97b35b9a818ec1fd9046afab489aad83ce34896ee8586efe402ea7739ecf088bc2db5c1c8e4fb39e6a0fc5b3adc6b4a9b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\50CVNBL2\jsll-4[1].js
MD5
211e123b593464f3fef68f0b6e00127a

SHA1
0fae8254d06b487f09a003cb8f610f96a95465d1

SHA256
589303ca15fba4fe95432dbb456ff614d0f2ad12d99f8671f0443a7f0cf48dff

SHA512
dad54d7941a7588675ea9dd11275a60fb6290e1582d1c7a4acb50642af3c2a4aa35e32edd8fa9dd01ce7fd777247d2706d5672a201633bf918b525936e93b14b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\50CVNBL2\repair-tool-changes-complete[1].png
MD5
512625cf8f40021445d74253dc7c28c0

SHA1
f6b27ce0f7d4e48e34fddca8a96337f07cffe730

SHA256
1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369

SHA512
ae02319d03884d758a86c286b6f593bdffd067885d56d82eeb8215fdcb41637c7bb9109039e7fbc93ad246d030c368fb285b3161976ed485abc5a8df6df9a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\50CVNBL2\repair-tool-no-resolution[1].png
MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMNCBGOH\SegoeUI-Roman-VF_web[1].woff2
MD5
bca97218dca3cb15ce0284cbcb452890

SHA1
635298cbbd72b74b1762acc7dad6c79de4b3670d

SHA256
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d

SHA512
6e850842d1e353a5457262c5c78d20704e8bd24b532368ba5e5dfc7a4b63059d536296b597fd3ccbd541aa8f89083a79d50aaa1b5e65b4d23fc37bfd806f0545

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMNCBGOH\c525a9a2.site-ltr[1].css
MD5
c41b93c6b685b6201e4d9690ae09acca

SHA1
bd8fb9d957fc941c9b5d0d19d799d5a6204c53fe

SHA256
9f7c87a6b80523bb7d3462fbd6ffd5830592b457744b43eb1a9541061e6428b5

SHA512
154af23c7462a23f57788cff4d905a9cbbd103be2782ef11a693610e1c78f3e7230d47c7c8bd10971536075635a3eede2a046e16cd3e5b590dc0e83fccbe2356

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMNCBGOH\latest[1].woff2
MD5
2835ee281b077ca8ac7285702007c894

SHA1
2e3d4d912aaf1c3f1f30d95c2c4fcea1b7bbc29a

SHA256
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f

SHA512
80881c074df064795f9cc5aa187bea92f0e258bf9f6b970e61e9d50ee812913bf454cecbe7fd9e151bdaef700ce68253697f545ac56d4e7ef7ade7814a1dbc5a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMNCBGOH\ms.jsll-3.min[1].js
MD5
db1c580cd28422b73814f0620aad00d9

SHA1
4dadd769be89f5b7c1843bd79434914132ec1c1c

SHA256
59e18de81c8c868b6d6276807f51a2b27e6a29ebdf44f55b520c11d5aac867d0

SHA512
2a8d4752a317990bc8bb5a98ac11d6b270c4d52fd3f3476870cb6f02fdf849999ab6f7d92645f217b1f83161fc21b475396083c04a5e42af476f337b0b3b7c83

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DMNCBGOH\repair-tool-recommended-changes[1].png
MD5
3062488f9d119c0d79448be06ed140d8

SHA1
8a148951c894fc9e968d3e46589a2e978267650e

SHA256
c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332

SHA512
00bba6bcbfbf44b977129594a47f732809dce7d4e2d22d050338e4eea91fcc02a9b333c45eeb4c9024df076cbda0b46b621bf48309c0d037d19bbeae0367f5ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y8KY8UO4\5cce29c0.deprecation[1].js
MD5
55bb21475c9d3a6d3c00f2c26a075e7d

SHA1
59696ef8addd5cfb642ad99521a8aed9420e0859

SHA256
3ceddaf5a1ed02614ec6b4edd5881a3ffb7ec08116154dff8eb9897230bf5e59

SHA512
35261ddaf86da82d27a29f39a7c6074a5f0e66f5b0a8098c7502289fb70b186371a7fe71410baab6cc6b726e9338afecee9f8bb075047a055723fb5e2f09b9c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y8KY8UO4\TeX-AMS_CHTML[1].js
MD5
a7d2b67197a986636d79842a081ea85e

SHA1
b5e05ef7d8028a2741ec475f21560cf4e8cb2136

SHA256
9e0394a3a7bf16a1effb14fcc5557be82d9b2d662ba83bd84e303b4bdf791ef9

SHA512
ad234df68e34eb185222c24c30b384201f1e1793ad6c3dca2f54d510c7baa67eabdc39225f10e6b783757c0db859ce2ea32d6e78317c30a02d1765aee9f07109

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y8KY8UO4\d1fe8758.index-docs[1].js
MD5
9cc8d7c7834f12d78aa10ccd8998635c

SHA1
459fe291b4540a722244fd1367d39bcaf6569123

SHA256
fcb53781930b59575ee13a89794a5a9363c5eff0ad6126cfa10b6460e573c13b

SHA512
838f4b410f3a1be2b74b981a91c2bed03ff9598964d9228878754d99e6842c2cb36b55be34ec6ddf1976f964d651df9df8b3c61c9e9f501ed91aab4d3aaee0e9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y8KY8UO4\wcp-consent[1].js
MD5
38b769522dd0e4c2998c9034a54e174e

SHA1
d95ef070878d50342b045dcf9abd3ff4cca0aaf3

SHA256
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294

SHA512
f0a10a4c1ca4bac8a2dbd41f80bbe1f83d767a4d289b149e1a7b6e7f4dba41236c5ff244350b04e2ef485fdf6eb774b9565a858331389ca3cb474172465eb3ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZP16XB2I\12971179[1].jpg
MD5
0e4994ae0e03d9611e7655286675f156

SHA1
e650534844a7197b328371318f288ae081448a97

SHA256
07b979b12f1cb506df7675efe227a2e78accfa1f5954af2b7bb66295e5cf881c

SHA512
07aaae5347fa8e82f86d0ba7c28127fac952d84bad3dce119654b5ba1cd2550c8d064770473f34f89fc383847b2f1594b3600d9fd01e6275d67868c41638e34a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZP16XB2I\24882762[1].jpg
MD5
ca711d527e0e1be012a3105699592812

SHA1
f02534ce002f6d734a897491a1ebcc825da565c7

SHA256
e68e548a3cc404e84af3fd7529c21d64a238ba5d0857feb8fa1652b439b36e6f

SHA512
a56a1266a76ee7c95424f5beaed9d65ea569e7d187beae3c4bc1fb3a018ac728f419a2b08b62c51a70e18ee82d54e1d7714092e609135bb455060ab7d01830b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZP16XB2I\2672110[1].png
MD5
7dc91895d24c825c361387611f6593e9

SHA1
fc0d26031ba690ac7748c759c35005fe627beb8f

SHA256
f37ad9b56d806d06267f9a290196dfe4200edb7729b41d789b8f1ec8adc5cdbf

SHA512
ba27fdbf02294cc78ede7972f20da383c20027ab172a4ea6ad5006ff58e404032d92f875e642dfe73985428c28bbbe1befc546c2666a672afacf23195425d7c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZP16XB2I\31348972[1].jpg
MD5
c09597bbae67e58e38228f9e8fa06175

SHA1
85aec568955ad5d9165364d37a9a141dd899eca9

SHA256
f62142fd084d46df32d9d8a340855fcb17b14376c36549b825670451ea7cae73

SHA512
b7592dcf34487e3ddbffd32e8d03cb5665330f8f687e10f39f16c67673238e340cf4633b8e921932c65e3c891286349378bb70ad9a8026046653c4cf8fa2efff

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZP16XB2I\MathJax[1].js
MD5
7a3737a82ea79217ebe20f896bceb623

SHA1
96b575bbae7dac6a442095996509b498590fbbf7

SHA256
002a60f162fd4d3081f435860d408ffce6f6ef87398f75bd791cadc8dae0771d

SHA512
e0d1f62bae160008e486a6f4ef8b57aa74c1945980c00deb37b083958f4291f0a47b994e5fdb348c2d4618346b93636ce4c323c6f510ab2fbd7a6547359d28d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZP16XB2I\app-could-not-be-started[1].png
MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZP16XB2I\application-not-started[1].htm
MD5
9ecf7d824e732de1dabb55e628502402

SHA1
98076e3cecba8ae885bb517b258df6a70df40322

SHA256
85abc2f4746e5c9b3a49e3eb30d851c86cf4cb6fe48db55a266f099304851a03

SHA512
69999e93ae7c7afc569f704339dc50c1252313bd68b03e1844a0638df8d29df4f6f60c6b576ac57804a845dd7a27f5e06ec76a4259a9b1ada4b3f8c07a41eb4e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\D3E241FH.cookie
MD5
16aa493a6588ffdcf0c493f1b4daee57

SHA1
c0d1523615b2d65045b0abb52b3f0341ecd674b2

SHA256
d03eab32b5356e96089d0ddf07c45278167cdaad31976843ab82169a5b97afa2

SHA512
d7a9354b01c663e3a95b77f621b1b0a9ec8442b33db607774ce186bef4c7e08835a8433b2e2479f323945becde7d3b323b1b9a8c5289541ef41385fef1102636

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\F993VCDM.cookie
MD5
d4fb0545ca83e92ac22be56bcee0dd49

SHA1
7dc035fb9b52f44c39eb8e0242997978e724c7a5

SHA256
7d0a2112d49c568827315eb711d887427ef73025ba4c47c906f72d25c65b8b30

SHA512
153943f25c276b88b40c751cd1ff961c944613e48504bb83605e5e9af7af22887fdc1cec56e430b53780b555a0488ceead1baef3e63cafe0ae25de8ea34b01e4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\KGEXZIQ5.cookie
MD5
abdb85747363ac5a04367c5694bf1a55

SHA1
0ab5206e6e0be8c18b13955b14b519a38644243a

SHA256
8b0290c37f75c837efc4a63a854793111a7c587fba371f14a077efc78fa50c0f

SHA512
3c79b41d4a4ce44086c22aee2520680ec58149e7e308a9fc455804ee24462fe970b9ed2a7cd537d217119afc0fe8cca4e88eaf00aeac87998076b832e2ec6e07

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\L2N9YSMG.cookie
MD5
0d76f29da9530cbe2749ca7c2b0b271d

SHA1
ab5ac7c5472064aa4ab9fa72b1683ae50c5f7007

SHA256
0bf945d85085646af876d8ee384cd2066c1ca5b6f4a8aaebeb304b979bc33b4e

SHA512
54dd8f259a728b768b76a621155487f63de4d527d851b36ced8fd5cd61110b54c0f8a73bf7cae44d96a6b0629ed7d7ac829c8f9792e2657f17b80c2b02dab6cb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\OCV8DEMA.cookie
MD5
dcf81c00b1b0fdf388ef59a55c630fd5

SHA1
1e34fe718d5ca7bf6d1af8ee37cfa3733e067dfe

SHA256
8edf49cf06d37313d174f119520ca635dc11a44ee43457e1a337cf51090ffbaa

SHA512
92ebcd4d2bb8ca17e3d944a68c2df64f71d01a10ea99c7b949d8ae911db1c31975c820f3f960482a2de4c6097b6f4c507a34854083c33c5e4ff8ab78b7760d40

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3
MD5
1d18a59ba00457e48a6991ef0609d984

SHA1
0f1c1a360502c66215375107eea22b1f9244d34d

SHA256
fc1f75272783a3db2ff99760c7199f0f27b1ad4ff951f5ba2fc95f49679fbc65

SHA512
c7d812de0fdc72fa52388937b8e8bf9e77f8a53d7588eb8a32ced162ea54188bdf8b6350e13c7d01f5bf743f4b8085b73796f41a8c3c8196be8aa3c9dcd440fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1
MD5
1071aa8cc3a6ad3ca8b0ddb7c6bc7212

SHA1
602ab5e29381bed0006f213c1c8041a9e329a144

SHA256
72dd0a38fea4c345e70ffdb06f026ea6ba2802ca2ce4eca2aeaa4363b3539ec4

SHA512
c0aa20ace09a1465f67cc573cdb9667410afe3bfe50108affa2c0ffc48aefb49c61e9a81e3c0a9115176465f78a94a0afdc8264217484a6e5576dd3992f7859a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
d36a9739d67d2ed28883c6b15178c09f

SHA1
f7934e133600461adf6273c2a29b54018a262d2b

SHA256
60ed02b7b4a6a3216c6092c65f45538203a388fefedd28f42ee5aa7b65f91a20

SHA512
cc2ef6efa0182f4912df4b49043164e8984b25f0af5ea83470e65dbe0eab98b20807724c1122e3cfdbc43fc7db8d5a617376f5c9c9dba8cb3b59b35788933f4b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231
MD5
b0102b478018efad4ea67b67563bda8a

SHA1
01e624a942b19520776ca26c912936fe5c294a7c

SHA256
86a0b1a26c3e013b8d29f96262f8b879ca41a08a7eb3a7517f85c338a2de33c6

SHA512
2cbc2336c265892c0fefae6c20beb5ae05286fc0acc50939957b6ca69f443ceffbee094f5fdc3719a9316c40f65703f3fe88d130ec8caf589d291b32d991aad4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
MD5
9886a0eeef4e4de16d55ddc65e9f58f8

SHA1
29e2fb15e0e4a084f86aceca92ba9b419f9943ac

SHA256
f382a785e245b1577a7c7a58753f2eebc023aecd22b28d4bb6bb7f9ee58680de

SHA512
6543a4b7fce52859779b262c482066a7ef1a0898e3b3e65d875171e9e6fd099372090a6147a31982e2b8ee266a5620b2ff38816fe27caafbbdc0e3c896cd0ef7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
MD5
869854d603cd7cf6ea3efb8f808122a6

SHA1
d0fb288c87ba040f77130390aa91de71354e4fe6

SHA256
51225f35317a6de45959cdf123e06c64e73534e443404504ece1e6ded67ba7be

SHA512
72f5ab9315aaeea2b377edb25bc59f7eadf4ce8ef3aab89a1de6beaf5d04fdee1f6b5255ebbf8f492022b1d9222b05c697f15cf42fc0861a665f7268517fd99d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
MD5
e9270f794b39a75130857d7d869bdfad

SHA1
6f65ecf0d017d7735a9ed0befdc33c7b10c2a27c

SHA256
582b35a58ad2332aa89070d76001d544861710f8d196ddaf324c3e0188dead3c

SHA512
9308870f17e834b575bbebb2b30f9eafdb480c7a7feebbc2a1d22cb9f623505e8952194dce6eb8e7ada7fcdbab3b4af16b2375cccb070588f46a3855b6a85a95

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3
MD5
b711bcdc9b144ccba645d662e445e260

SHA1
976a0f17ed874af8e8b722ff90a61a1bacf0862a

SHA256
dcb5d928e7f3be0b429e54ecc022c163754a1d82ff03520d6adf51199f111c5e

SHA512
bcf6b0dc0fab7bc87d2dd5613493b3353c1237f16d0b896d76112ce4cfd6b6d5f3405c5dd232d91c919595c5c807037552a61f12a36ec207a64da4c42ac36f98

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1
MD5
3b7d92c74fb5d0dffa3f6cf9847a7567

SHA1
a10390f0d619be8d83a5d0b9fb8abd3952caa9b7

SHA256
c6743af981843eec48d3490c38b80acbadf9dffbc7195ec1e08aa54ea850264a

SHA512
8f5b7582c994ee82204822f1351ea730b1a3edc9440d5c0ca5b59c6121d8dc6d58908cf7df7e086fd74a4278def40577e09c9584bdd4d140f82b189d514bdd08

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
9010633ea410a09d0fa0e91cf0c26712

SHA1
2a55053e10fb65a0d8f04f5ffba879ed80146868

SHA256
8c7b53c863240eb74b56679965b09b20150ca49b8e590884fa9c5ba9303de113

SHA512
61fd380da1ece26f685769326a4bc8ce06d769e52b1f4ef06625ab749a17ae4fae723f8f316f3afa996dc374bad4cfd2fee92a4b438b591cdae9b17a734d49c8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231
MD5
07a3d0ced0ea7dbb2a831377b07a35c2

SHA1
38635cc989c7c5285e91620c92bc38fef2976658

SHA256
32bcf6c0b37be371af3aa6af885bc66d43b229036b842808fb13d2752236c41d

SHA512
0f4a007636d6119cdadeff8f8a18b2d755b4d29e1db14c84ae92201c82ca2868bf7979b1299c2693d8a45f74938bbb1b1df900423381d2c5efce4ca4e6bf5773

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
MD5
27715e51c627e64f189b108ae6a2fb9f

SHA1
056e908235142bf1f94d3e3fba2af807d9e39dcb

SHA256
6439fd0dfa9babb79c09921a44c0350f05527681a25c84fffe0a971683b72606

SHA512
a470c86ecdebbff1e380a313186d6241d95b376521ca8fa1360ff5a859fbc8579280837a24425210d2bb0f2d7a42c72dd53c7d8f9ab2b2a42f7b11901cd9b8e4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
MD5
0319476493ee7a5925fa8964203bbcd5

SHA1
f2ca0d60a747a9be8e312e76a567e1186e61f93b

SHA256
98a24e357c5743dbdb809fef2e18bf4505b9a67c6b4ed535404eeffe8bab0ae2

SHA512
1c8cf7926bea07e3964560d3e0a418832fee58a648ee6d0a11233057d6d19271502b23cabbde9a06c897a6fad729e3ea273f32edc56c4ab9e903d75808a3eabb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
MD5
77bffd0396e3d5330f515aafd54acdee

SHA1
5341ca0ffcc4066fb068d18cd146646c13da6b87

SHA256
7024f49e76db04aa3efdc977f68efb992631c6510b26f8b098416e6af85d0567

SHA512
9b6c17946986bec3457062de69e628e2eac89f276bc78e32548e34052725957b030839d4499a483e583daef00ebe78dc0267d2a15d9babb1b8bd021d29a31fea

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2274612954.pri
MD5
0db264b38ac3c5f6c140ba120a7fe72f

SHA1
51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

SHA256
2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

SHA512
3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
MD5
d4a0034551d0e637e42405b569c6e246

SHA1
d2df2a71a2d256503a1a6f820e078ce1ef08cb69

SHA256
b446961222fbf2a3cb5d6a8b8bff152591c63ba401e78c82038bf5f6c2630887

SHA512
50bdf8ede6519ab447a5955e4c430a2cb890338f8b2334a3a5f553292b02fbb1e78ca78e41d668d50c7a9655b335c995620dd6d6e50aaf1d75390186559582e0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
MD5
c4e7c15f270be1a3cff7f01d5f4e1127

SHA1
327e6c19145605b177d7a8674de86182335404fc

SHA256
176251aaa003e32d39ddf1b6341ad712c829c402747c34b098acc16ffe9ef176

SHA512
5fcffb117eb5da01b1981e9c84d336e868c79f58c3eae8b3db5149554f5c1b5d3f8393b500a34cabfcb65dd6d9e5c3c42846f57ec11f40fe7bcf8a01edec6fd2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
MD5
58222bdd8c0a5ec34d6e38f8b49695c4

SHA1
2f42b5890b4fb36afd54d05815e570102bb91dca

SHA256
0de0ab47696a09f8afe2234cb4f947864e34b0424d3ee15b009923b4fa84ae9f

SHA512
7c23d757e6deae5545499c27a77c8346fcb5b0ed5bc148b62bacee8ec9c46a5e34488deeee5704120e1c6564020c5f428822f5d67cac96ca59e57b7311f5b7a3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
MD5
54ddfea39c4b436f2e83c5e297e392e1

SHA1
4aed698c06be24c61de0bb332df606d4cc877c7d

SHA256
6f711ac80737f8b0c00921beea0c9139b78447197a49e567fd846b4c358b76dc

SHA512
1129b88f0a63dbc4d75f5c3ce7985351144b943a28500b93e916bbf5410848fdf13e78e6241f5921128cd021eb3af858e764bd3d6928ac2e9273ecc09d7b752f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{E9A3B5C2-FC11-4E4C-BF25-DC24AB000AF5}.dat
MD5
c4d75152e5cbb837423e7b04bd43ccae

SHA1
aa89cdacc52134e5afb70bea3207d219be47831f

SHA256
af2228fce2b29ac868eeb446e67ff85da650b1fdfbd66e2ef576dda176569cc6

SHA512
1c1d18a343298ebfd356e1ed4ca032c02656d44960f57787907d56cfe8d0829513c628b422b5cbc9c4399e5cd6d3291adeda9238a76d27ad0a544b67e82b8225

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{A229B53A-419B-49F0-81FE-A3870B806123}.dat
MD5
36c3bf51126260af59d33a60e066c4a5

SHA1
669e5424797fc3b16b9289e7cd4185e4c0b613c1

SHA256
c6f45c724e91f936dac0eecba10ea479e475006fa3c1b476fb3f477c2dd504f7

SHA512
e1a4166a95eb4f03ceb081f1eaffc5faa49c695ce67b6c94dd663f3feb33d941fd8c9921895332afc20c363194171ffaf459c46cf49ec6f8649bc92fb5b1c414

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2274612954.pri
MD5
0db264b38ac3c5f6c140ba120a7fe72f

SHA1
51aa2330c597e84ed3b0d64bf6b73bf6b15f9d74

SHA256
2f6955b0f5277a7904c59e461bfa6b06c54fece0d7c11f27408fa7a281a4556d

SHA512
3534c243516cef5cee0540d5efd5cde1f378e127e6013b5e309a2e0be8393417bfe458706564b4b955f92132a51e2772c67f9fd90441476cc3512a5d9f910d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
7ef191cb819534082a413264906cb4fe

SHA1
ee476fc3b463821d25a7862a3d45595c60775a4d

SHA256
9b0c01428ea7e0e3b8a83b5a78bad43817d2f1bfaf25da14b9a770fc57e4da5c

SHA512
b7f12dd33dc93aa5e5ec503f7d40af7d73d15700f476d7a261b7d72086ddf4d616f4924f3736510074ca33ded6dfe0e049274e9c0439c675a9cfd645fb7c5f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5E62.tmp
MD5
7069050ee3a8a940b221db9e58e7f382

SHA1
a9d7e6aab0b5c86545326c384bf1bc552bef15b7

SHA256
3d68f7e51ae3ba497b76b78a462b768b52956ea8ae5a39ce50c6cb562e3bb1f9

SHA512
14df204fc0b797361def547ffe97484e40a2e148bd99cebb4cd298543fc32b19ccfd9db173657ebccf08e17ec2d9deb4b983ca3a5ee024c74236c58fd68b13ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA7D4.tmp
MD5
7069050ee3a8a940b221db9e58e7f382

SHA1
a9d7e6aab0b5c86545326c384bf1bc552bef15b7

SHA256
3d68f7e51ae3ba497b76b78a462b768b52956ea8ae5a39ce50c6cb562e3bb1f9

SHA512
14df204fc0b797361def547ffe97484e40a2e148bd99cebb4cd298543fc32b19ccfd9db173657ebccf08e17ec2d9deb4b983ca3a5ee024c74236c58fd68b13ec

Download Submit
C:\Windows\SysWOW64\VLC\Vlc.exe
MD5
8b7fed1914705666e4826519ebf2ebe7

SHA1
7916166229867d620b4b07a359d0bf92e6574b47

SHA256
4ccfbfb6751aca04fdefe4f96f95a322ac9684d62dd79c5f7d142c24f30eb5e8

SHA512
e602fd1acd3be2513d63e6335c564b17232ac9396d82818868e84534bc09ba57a8ce71db90cbe307bffb2cd13acaca580eaa59f7ea56f3b1d3494c56248ca1e1

Download Submit
C:\Windows\SysWOW64\VLC\Vlc.exe
MD5
8b7fed1914705666e4826519ebf2ebe7

SHA1
7916166229867d620b4b07a359d0bf92e6574b47

SHA256
4ccfbfb6751aca04fdefe4f96f95a322ac9684d62dd79c5f7d142c24f30eb5e8

SHA512
e602fd1acd3be2513d63e6335c564b17232ac9396d82818868e84534bc09ba57a8ce71db90cbe307bffb2cd13acaca580eaa59f7ea56f3b1d3494c56248ca1e1

Download Submit
C:\Windows\SysWOW64\VLC\Vlc.exe
MD5
8b7fed1914705666e4826519ebf2ebe7

SHA1
7916166229867d620b4b07a359d0bf92e6574b47

SHA256
4ccfbfb6751aca04fdefe4f96f95a322ac9684d62dd79c5f7d142c24f30eb5e8

SHA512
e602fd1acd3be2513d63e6335c564b17232ac9396d82818868e84534bc09ba57a8ce71db90cbe307bffb2cd13acaca580eaa59f7ea56f3b1d3494c56248ca1e1

Download Submit
C:\Windows\SysWOW64\VLC\Vlc.exe
MD5
8b7fed1914705666e4826519ebf2ebe7

SHA1
7916166229867d620b4b07a359d0bf92e6574b47

SHA256
4ccfbfb6751aca04fdefe4f96f95a322ac9684d62dd79c5f7d142c24f30eb5e8

SHA512
e602fd1acd3be2513d63e6335c564b17232ac9396d82818868e84534bc09ba57a8ce71db90cbe307bffb2cd13acaca580eaa59f7ea56f3b1d3494c56248ca1e1

Download Submit
memory/2312-211-0x0000000000599B8E-mapping.dmp

Download
memory/2824-156-0x000000000042F71D-mapping.dmp

Download
memory/2824-159-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3060-228-0x0000000000599B8E-mapping.dmp

Download
memory/4128-137-0x0000000000000000-mapping.dmp

Download
memory/4128-148-0x0000000004E20000-0x000000000531E000-memory.dmp

Filesize
5.0MB

Download
memory/4436-152-0x0000000000000000-mapping.dmp

Download
memory/4568-162-0x0000000000000000-mapping.dmp

Download
memory/4584-160-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/4584-161-0x0000000000599B8E-mapping.dmp

Download
memory/4632-158-0x0000000000000000-mapping.dmp

Download
memory/4652-126-0x0000000009AA0000-0x0000000009B15000-memory.dmp

Filesize
468KB

Download
memory/4652-118-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/4652-117-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4652-115-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/4652-119-0x0000000005A40000-0x0000000005A41000-memory.dmp

Filesize
4KB

Download
memory/4652-120-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/4652-121-0x0000000005C30000-0x0000000005C31000-memory.dmp

Filesize
4KB

Download
memory/4652-122-0x0000000006570000-0x0000000006571000-memory.dmp

Filesize
4KB

Download
memory/4652-123-0x0000000005B70000-0x000000000606E000-memory.dmp

Filesize
5.0MB

Download
memory/4652-125-0x00000000098E0000-0x0000000009996000-memory.dmp

Filesize
728KB

Download
memory/4652-124-0x0000000001930000-0x000000000193E000-memory.dmp

Filesize
56KB

Download
memory/4808-127-0x0000000000000000-mapping.dmp

Download
memory/4900-130-0x000000000042F71D-mapping.dmp

Download
memory/4900-135-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4900-129-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4936-131-0x0000000000000000-mapping.dmp

Download
memory/5000-132-0x0000000000000000-mapping.dmp

Download
memory/5008-167-0x0000000000599B8E-mapping.dmp

Download
memory/5012-133-0x0000000000000000-mapping.dmp

Download
memory/5080-136-0x0000000000000000-mapping.dmp

Download
memory/5172-234-0x0000000000599B8E-mapping.dmp

Download