Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-09-2021 09:24
Static task
static1
Behavioral task
behavioral1
Sample
Payment.exe
Resource
win7-en-20210920
General
-
Target
Payment.exe
-
Size
149KB
-
MD5
46a9cde2229b45d390ad40ce0cc997f9
-
SHA1
ddf3a356e42d2a15ccd930b0d5c6d7077824ef8f
-
SHA256
4c4a0595a5ac3499e7d398aa9cbbea5fc5a77836be706c50bbae6dd7c0c6aadb
-
SHA512
75a082b7a9a0df0a2b9f26fffcf8592f13d46c2b5bffc8830a100efcdd4cfa8394bb2a567f74c4c890f4f9cdcdeb103900cbb2990494971a119e2d128910340f
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.aquaclima.gr - Port:
587 - Username:
[email protected] - Password:
N]t+~*2=X1@o
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2572-130-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2572-131-0x000000000043760E-mapping.dmp family_agenttesla -
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1196 AdvancedRun.exe 1552 AdvancedRun.exe -
Processes:
Payment.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Payment.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths Payment.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Payment.exe = "0" Payment.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection Payment.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Payment.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features Payment.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions Payment.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet Payment.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" Payment.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" Payment.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment.exedescription pid process target process PID 904 set thread context of 2572 904 Payment.exe mscorsvw.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "338471927" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000007dd464504d55e054c7ce1198266e815f556c568dd1dddb915245ee4acedabe3965b66595964f9767090040e9991e4e1dde523dadd4e7e204c836 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2751bd67a4afd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3de4586da4afd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c34c1a68a4afd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7b657669a4afd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "339146880" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = f0579e0b39b0d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "339125161" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000001c8188a26e8b2cde4e78f7dc618da18ea4baf2e5e2eec0f71b1e0125712c7037652d04ab95a654a3e6c62d86a8c110eb07bdd7feff06fc76517746493c41e8f1d88ecbe8bda2ad03887295fc70a52d7d6557b6a00529f5501959 MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exePayment.exepid process 1196 AdvancedRun.exe 1196 AdvancedRun.exe 1196 AdvancedRun.exe 1196 AdvancedRun.exe 1552 AdvancedRun.exe 1552 AdvancedRun.exe 1552 AdvancedRun.exe 1552 AdvancedRun.exe 1520 powershell.exe 1520 powershell.exe 1520 powershell.exe 904 Payment.exe 904 Payment.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 1556 MicrosoftEdgeCP.exe 1556 MicrosoftEdgeCP.exe 1556 MicrosoftEdgeCP.exe 1556 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
Payment.exeAdvancedRun.exeAdvancedRun.exepowershell.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 904 Payment.exe Token: SeDebugPrivilege 1196 AdvancedRun.exe Token: SeImpersonatePrivilege 1196 AdvancedRun.exe Token: SeDebugPrivilege 1552 AdvancedRun.exe Token: SeImpersonatePrivilege 1552 AdvancedRun.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 2964 MicrosoftEdge.exe Token: SeDebugPrivilege 2964 MicrosoftEdge.exe Token: SeDebugPrivilege 2964 MicrosoftEdge.exe Token: SeDebugPrivilege 2964 MicrosoftEdge.exe Token: SeDebugPrivilege 3252 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3968 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3252 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3252 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3968 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4788 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4788 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2964 MicrosoftEdge.exe 1556 MicrosoftEdgeCP.exe 1556 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
Payment.exeAdvancedRun.exeMicrosoftEdgeCP.exedescription pid process target process PID 904 wrote to memory of 1196 904 Payment.exe AdvancedRun.exe PID 904 wrote to memory of 1196 904 Payment.exe AdvancedRun.exe PID 904 wrote to memory of 1196 904 Payment.exe AdvancedRun.exe PID 1196 wrote to memory of 1552 1196 AdvancedRun.exe AdvancedRun.exe PID 1196 wrote to memory of 1552 1196 AdvancedRun.exe AdvancedRun.exe PID 1196 wrote to memory of 1552 1196 AdvancedRun.exe AdvancedRun.exe PID 904 wrote to memory of 1520 904 Payment.exe powershell.exe PID 904 wrote to memory of 1520 904 Payment.exe powershell.exe PID 904 wrote to memory of 1520 904 Payment.exe powershell.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 904 wrote to memory of 2572 904 Payment.exe mscorsvw.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3968 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3252 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3252 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3252 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3252 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3252 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1556 wrote to memory of 3252 1556 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment.exe"C:\Users\Admin\AppData\Local\Temp\Payment.exe"1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exe" /SpecialRun 4101d8 11963⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ETZK5XMY\12971179[1].jpgMD5
0e4994ae0e03d9611e7655286675f156
SHA1e650534844a7197b328371318f288ae081448a97
SHA25607b979b12f1cb506df7675efe227a2e78accfa1f5954af2b7bb66295e5cf881c
SHA51207aaae5347fa8e82f86d0ba7c28127fac952d84bad3dce119654b5ba1cd2550c8d064770473f34f89fc383847b2f1594b3600d9fd01e6275d67868c41638e34a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ETZK5XMY\24882762[1].jpgMD5
ca711d527e0e1be012a3105699592812
SHA1f02534ce002f6d734a897491a1ebcc825da565c7
SHA256e68e548a3cc404e84af3fd7529c21d64a238ba5d0857feb8fa1652b439b36e6f
SHA512a56a1266a76ee7c95424f5beaed9d65ea569e7d187beae3c4bc1fb3a018ac728f419a2b08b62c51a70e18ee82d54e1d7714092e609135bb455060ab7d01830b5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ETZK5XMY\2672110[1].pngMD5
7dc91895d24c825c361387611f6593e9
SHA1fc0d26031ba690ac7748c759c35005fe627beb8f
SHA256f37ad9b56d806d06267f9a290196dfe4200edb7729b41d789b8f1ec8adc5cdbf
SHA512ba27fdbf02294cc78ede7972f20da383c20027ab172a4ea6ad5006ff58e404032d92f875e642dfe73985428c28bbbe1befc546c2666a672afacf23195425d7c2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ETZK5XMY\31348972[1].jpgMD5
c09597bbae67e58e38228f9e8fa06175
SHA185aec568955ad5d9165364d37a9a141dd899eca9
SHA256f62142fd084d46df32d9d8a340855fcb17b14376c36549b825670451ea7cae73
SHA512b7592dcf34487e3ddbffd32e8d03cb5665330f8f687e10f39f16c67673238e340cf4633b8e921932c65e3c891286349378bb70ad9a8026046653c4cf8fa2efff
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ETZK5XMY\ab05050c.index-docs[1].jsMD5
9f5759e30866f25b0fd72bf0a7253989
SHA1ddb0b05998d9567c5933a624844781010e63b595
SHA2561b857475b083bc0c34feb5d2dd90a2e013ed865042354dab015486a12339952a
SHA512fb3057de1a92319dc008e57f620480e335a1437419ce9e8e01afa3cc02a91639d4c741f1ed3d929892e411b75aa5ce5e3eea1532a648227874c418fc45851821
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ETZK5XMY\install-3-5[1].pngMD5
f6ec97c43480d41695065ad55a97b382
SHA1d9c3d0895a5ed1a3951b8774b519b8217f0a54c5
SHA25607a599fab1e66babc430e5fed3029f25ff3f4ea2dd0ec8968ffba71ef1872f68
SHA51222462763178409d60609761a2af734f97b35b9a818ec1fd9046afab489aad83ce34896ee8586efe402ea7739ecf088bc2db5c1c8e4fb39e6a0fc5b3adc6b4a9b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ETZK5XMY\latest[1].woff2MD5
2835ee281b077ca8ac7285702007c894
SHA12e3d4d912aaf1c3f1f30d95c2c4fcea1b7bbc29a
SHA256e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f
SHA51280881c074df064795f9cc5aa187bea92f0e258bf9f6b970e61e9d50ee812913bf454cecbe7fd9e151bdaef700ce68253697f545ac56d4e7ef7ade7814a1dbc5a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OMDSD8ZQ\3bb4018f.site-ltr[1].cssMD5
0cc207b5e2134cef689288c5df5d945d
SHA1394f88591e6b5affa1d4c64e8b621a54d4f74aa9
SHA25678e1ff94196648506f0e8eca96115660d7a7784a0a05852873d77af6694e51de
SHA51277692d89bdb8e49c77ae161975af8fc323159877a1168a7305d80ebe6aeb83b56a8e09a3c90e3c87e570bdd13e8753af4a0fdcd7ddd3da8d60970ab01b202344
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OMDSD8ZQ\docons.97a9e7db[1].woff2MD5
5d062f872c1600833f39feb797a9e7db
SHA13fef40e5e5a99058821699be07e35a4328e255c4
SHA25678dbf0f234ec92b20a4354ff1391709f63ba3dc973f14b0e7e3fd52f12a10a4c
SHA5127fac8479c7b7a1fb954c1ac311b2f4a7019f8bfb5c601f099a562de7af777b5e14ec3816b9425a0bf07250a12adf811a0bb700e0d1f37d9f9f3c3d69576aac45
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OMDSD8ZQ\repair-tool-changes-complete[1].pngMD5
512625cf8f40021445d74253dc7c28c0
SHA1f6b27ce0f7d4e48e34fddca8a96337f07cffe730
SHA2561d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369
SHA512ae02319d03884d758a86c286b6f593bdffd067885d56d82eeb8215fdcb41637c7bb9109039e7fbc93ad246d030c368fb285b3161976ed485abc5a8df6df9a38c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\OMDSD8ZQ\repair-tool-no-resolution[1].pngMD5
240c4cc15d9fd65405bb642ab81be615
SHA15a66783fe5dd932082f40811ae0769526874bfd3
SHA256030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07
SHA512267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VOPSBAKJ\5cce29c0.deprecation[1].jsMD5
55bb21475c9d3a6d3c00f2c26a075e7d
SHA159696ef8addd5cfb642ad99521a8aed9420e0859
SHA2563ceddaf5a1ed02614ec6b4edd5881a3ffb7ec08116154dff8eb9897230bf5e59
SHA51235261ddaf86da82d27a29f39a7c6074a5f0e66f5b0a8098c7502289fb70b186371a7fe71410baab6cc6b726e9338afecee9f8bb075047a055723fb5e2f09b9c7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VOPSBAKJ\MathJax[1].jsMD5
7a3737a82ea79217ebe20f896bceb623
SHA196b575bbae7dac6a442095996509b498590fbbf7
SHA256002a60f162fd4d3081f435860d408ffce6f6ef87398f75bd791cadc8dae0771d
SHA512e0d1f62bae160008e486a6f4ef8b57aa74c1945980c00deb37b083958f4291f0a47b994e5fdb348c2d4618346b93636ce4c323c6f510ab2fbd7a6547359d28d5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VOPSBAKJ\SegoeUI-Roman-VF_web[1].woff2MD5
bca97218dca3cb15ce0284cbcb452890
SHA1635298cbbd72b74b1762acc7dad6c79de4b3670d
SHA25663c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d
SHA5126e850842d1e353a5457262c5c78d20704e8bd24b532368ba5e5dfc7a4b63059d536296b597fd3ccbd541aa8f89083a79d50aaa1b5e65b4d23fc37bfd806f0545
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VOPSBAKJ\jsll-4[1].jsMD5
211e123b593464f3fef68f0b6e00127a
SHA10fae8254d06b487f09a003cb8f610f96a95465d1
SHA256589303ca15fba4fe95432dbb456ff614d0f2ad12d99f8671f0443a7f0cf48dff
SHA512dad54d7941a7588675ea9dd11275a60fb6290e1582d1c7a4acb50642af3c2a4aa35e32edd8fa9dd01ce7fd777247d2706d5672a201633bf918b525936e93b14b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WAMIA80S\TeX-AMS_CHTML[1].jsMD5
a7d2b67197a986636d79842a081ea85e
SHA1b5e05ef7d8028a2741ec475f21560cf4e8cb2136
SHA2569e0394a3a7bf16a1effb14fcc5557be82d9b2d662ba83bd84e303b4bdf791ef9
SHA512ad234df68e34eb185222c24c30b384201f1e1793ad6c3dca2f54d510c7baa67eabdc39225f10e6b783757c0db859ce2ea32d6e78317c30a02d1765aee9f07109
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WAMIA80S\app-could-not-be-started[1].pngMD5
522037f008e03c9448ae0aaaf09e93cb
SHA18a32997eab79246beed5a37db0c92fbfb006bef2
SHA256983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7
SHA512643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WAMIA80S\ms.jsll-3.min[1].jsMD5
db1c580cd28422b73814f0620aad00d9
SHA14dadd769be89f5b7c1843bd79434914132ec1c1c
SHA25659e18de81c8c868b6d6276807f51a2b27e6a29ebdf44f55b520c11d5aac867d0
SHA5122a8d4752a317990bc8bb5a98ac11d6b270c4d52fd3f3476870cb6f02fdf849999ab6f7d92645f217b1f83161fc21b475396083c04a5e42af476f337b0b3b7c83
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WAMIA80S\repair-tool-recommended-changes[1].pngMD5
3062488f9d119c0d79448be06ed140d8
SHA18a148951c894fc9e968d3e46589a2e978267650e
SHA256c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332
SHA51200bba6bcbfbf44b977129594a47f732809dce7d4e2d22d050338e4eea91fcc02a9b333c45eeb4c9024df076cbda0b46b621bf48309c0d037d19bbeae0367f5ed
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\8GV4S4DS.cookieMD5
afb2bcba3c860537e9bffa5025879298
SHA189edfb574a306d4630f496261fe5bf1fb0c115c7
SHA25648a78d8abde7a724789bb2031ff5f48fd9d2b2610ca5720e85062614e8b98469
SHA5123fce49ad2f7cfee31c2e9bb087875272a2dd087dfb3fc63934a774fa8969feef2d9e1d920c6dbdff264856a814d0920f7555aef3edcaff2626bb0ae822f252f3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\D0BUQPG5.cookieMD5
2ed59c12422ef69e892d765184c19095
SHA15ee95fa53b7603c443fa52da0b29efc31989065a
SHA256ee0af17fa0f1263ad1adf2baf34895467a2390076235f229f85c5897904c3ba6
SHA5120987335b251e7a62798c70e844989b2b9b3c6d21a54756cbfa8cb7c5fd04ce1946281f88e8779339e39c369271a1492cfc75afa81e3ff161caac8da0d10c2bd2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\N29629JP.cookieMD5
a431bfc4a745efe72a4144a96325a6cc
SHA1b4c0e78d480b62bc0b7a493d50043cc3f6c2d0f7
SHA256bf022d31ab9c65a6d6c24c76fda69ff7f0f4471f96b8358df045cd9eda855f7c
SHA512b289a4bb7b07cdd5cf3e780ec2be45a56884b3c8ce014749580fd8509a0cff9ecbfbf0b8f16767a7abefada5821b466358340509b156220b16f1066f4ca265b1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3MD5
ff653377521bcd092209ef2805deefa6
SHA12a2e1bb465275fca6a15ee436321a543f2e8a47f
SHA25680f234ad79398b65cda97a414b1580d101e82aa55ca3851ced5ae5a4a7fd1f30
SHA512e80755fc2e250085910c27ef376017f9ab49bdda0a7b4144eb1e617bd7871880be553608af6c250775f3929501044f1fcd5a46727df759cfa9dfb9d35e673aa8
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1MD5
c981829fd9a6466fed2a569b4759cb69
SHA144381574795d103f1f1fead9656a25a8ca5fe476
SHA25600cb7275f1cce7de89a5c7778409fb3b111f93ef50c3e78f55f26878e6fe857d
SHA512ee32a0e527fcb51bea149b3ada4a70bcd18a753cc1d2c5c8a4799b8e801f4dd0875b465f409f6697a795c090fd49d26cf063b338cf8deb9dcadec42110e800fa
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63MD5
1c76ad47cf4f5e51693ed8c6d99002de
SHA1cf2914b7d39ef5a4428ef3ab9cf5e85ac4b92f5d
SHA2562310ebe1062d3ce79ea17a779b441840b8f9f42a3cba988489cf4cf305fe9e57
SHA512a87fe88cb29d29e047b22b1ff87944d4f76a6b91185dbad3ad135b0240107a36cd1964a5456011476bca9589ff30db6ddd76abe4167fa74a6dfd3bc27e1ccb2c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231MD5
e1428cb3ed8812f06878d21a30623ff7
SHA1c21f715129c5f0ef7e21fe22b364734616848c06
SHA2567d2dda2400642083263c94e3854aedafdfbd2ab83f33aaa043217795595d5eb1
SHA512811a2e30428c5b9c5b1b9d34b3af97c8a1a2af954ac90eaa60fe3ca9baed65e72db903a53751e077b73d0bdf9221f14f870e8d94cd47fa610b5ad205c64b8b33
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868MD5
78691cd717bc04b84de1957b7801576c
SHA14ac12db9310a0b6b0b2d00c101f7114567de8828
SHA256dda39d6a7f338073ed86ec5d1697498b10f13d663bc5b74d8de8151a9e82bcf2
SHA512cdf17faabf93a7313e8fe545ad862bf79c3c23c08250b643bbcf812e4726c65c7bb07dac28bdee7827667edb70a302605018ad89670358ed73d52b71881a19c9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04MD5
038a4f6cd83c541bc6d7b7d73f7a53cd
SHA1b2c6acd13f5a9220cd51e53e6e4f380c864fe22e
SHA256914f689b37ce7120182627e61e0ea09245cc1c8f195dea7164a0d99e9d292a13
SHA512c7ede9ca9817bdb2c38bd567ffb40165d949ab5310eaadc32ec0a659707980b9609ba2fdd7041e83edc9b1e3e3b336383b2dfd767a0ef6104479eeb74ce23364
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABMD5
38bdfed7f2a6b2923608e3eeb1214ae0
SHA194278781090bd2cb7691f8b16f4f1a89cb6860d6
SHA256769aa6f3b4747bd5bdb049065c45f8e294bf0bf8d84cf8f3fdb49210e35f1b10
SHA512029cb5c9ceb8bafcd5e5792f07094b4baaa9907a1150ea9051f02b2dc39c5fd0a64ba4e1c52ce27a86353d8ffdf179e21455398a49b0f9a2834d427b09b11d8c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3MD5
f88277152f2b07627ab9d8f70a9f8f4d
SHA17a8978d73e72e730c25fb08e31bbaa0b50ad505a
SHA256bd924c462118f8f1e95b3b6411baa70084f864d5dd313c9a71442dedf0751313
SHA51256137a5e925672712ac6726b838faba916e0ee534077ad17c1237f1f2884e2be9ec9cd7cc7cd1bfbaec21144ffef180c6933ae6d615ec43b3cb073fd73d1bf82
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1MD5
57682d2db4b717567a5e56262f4da5ba
SHA1961c0d1cc1c70d028e3dda3f8e4f626a6c29f12a
SHA256425a17d30cd28b54be21ab3a3b82a29cd9f57f2f604a95a94ba8531e608ca90a
SHA5124f682ff4dc2d508a98b3631c9342cbe783f7a881bc30de9ee66cfb38f6e76545cb0d50324292cb53f1fa31b3fc4a671a8393b3032446989198ca192b86ad3875
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
12f195dc5d4280bcdb7251634d1ad018
SHA13237604c52cbad411394c42850816508c5aece3b
SHA2569e445925ffa0be3fe8119fa5107959cd92484df1a1d7894befb60adfe762c7cb
SHA5124b89c12d5e40a877d9bae4b00fc82a433e893f130322349a33e9d73219d0c964f8986ad6c79c00ce51db09ed1ec7d99e9d503b309bdae698ef96862669215c88
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
12f195dc5d4280bcdb7251634d1ad018
SHA13237604c52cbad411394c42850816508c5aece3b
SHA2569e445925ffa0be3fe8119fa5107959cd92484df1a1d7894befb60adfe762c7cb
SHA5124b89c12d5e40a877d9bae4b00fc82a433e893f130322349a33e9d73219d0c964f8986ad6c79c00ce51db09ed1ec7d99e9d503b309bdae698ef96862669215c88
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63MD5
a2dbffb928bf6b19411fcdec6cf36a83
SHA18e7c5303f2c4caf9aba3e86cef0b444e534aca4e
SHA256a473341e32af5572eda815f48763bf4b6e374e687cbd66038774515ad8e0d41a
SHA512e0dc863c2e742ca5d2a206311224ff2da7c096e0ae1f31ceeeaf20b80325690e80c0b32d6ae2bb512735a12f1b87c530e5dfbc12c1e998bde9bfcbf3b64c1cbb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63MD5
68b96e14fff653e2c1b0f7afffca0037
SHA1cedb2dbdcf2a07f3342548a4c54ed796fc86839b
SHA256f02b6a3754e0b70c7099912b0a3e0c8b1a89b782a9d40c102efd6147098e7361
SHA51248ca63345a29bac85bf791b68d40b10d1dca140cbdf442ee51cfec71563b5a30127f7f7a791a8861238cc79a6b8b6931e69225183c2829ee9a10f4e9b45b64af
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63MD5
68b96e14fff653e2c1b0f7afffca0037
SHA1cedb2dbdcf2a07f3342548a4c54ed796fc86839b
SHA256f02b6a3754e0b70c7099912b0a3e0c8b1a89b782a9d40c102efd6147098e7361
SHA51248ca63345a29bac85bf791b68d40b10d1dca140cbdf442ee51cfec71563b5a30127f7f7a791a8861238cc79a6b8b6931e69225183c2829ee9a10f4e9b45b64af
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231MD5
e15eb4e37a63f5e8e7d566c9e66ada2b
SHA1386abcd84e817debc3c326f7023448cc722e02e8
SHA2561f2089abe2ba08fe86338e7827e53910fe2fc98425a8603a7f79a296ff39443f
SHA5125285674eba13d7deb7c01f22b47f17bff49504df7e98fb83907f2137d605b758f7e88aa394808be63bdcd71769667907deee6ff315abc2e28975e0cc65e2d0dd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868MD5
83d46f5af0e4b685f5ab7756a601fb01
SHA143a635b4c5afa237cf7c22179c64fd58642ee761
SHA25633ed71b7455749c52e78903cbe8956313f04e0ad326f6deed0d3dc53265f1866
SHA512925fc37b7ab8fd4cd545016003f3b337ab75ffd73ce6253210bf759329b2b4f943cf01de2da01755d56a5737b0fd5d151a471384629fae9362432521c42eca67
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04MD5
8e7901b4aa7d41deb57af0463d3a2853
SHA191ffd1baa8e5b0f38964bbd20c980a5c087896ba
SHA25676faa8c23b38158ce94d73a5e7a26e48dba78eea4412d4854e4d5b332981b05e
SHA512900ffa313caa4919cf8a01918ce0620388de7016262698441f57f38142a7d713ab9ecfa1d4cc8e7d6f0d34fc4551666815f30e93362753b801d37963d5722bb3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABMD5
6ec1aa6ee958604434147c0fb97280a9
SHA10731c5f1261557e96255127431782b9641a22385
SHA256aa473eea8983e9e9e83312e6ef06fe82ec646127f4169e67e9a3fcd8b685be2b
SHA512c2f0cbb918a3ff5e1e07db30a35ca7400d18e776b26bcf19e49f2b7778295a65d6d49f2a8a0c7be967bf594ffa96e4cb2e9c6d0dd36bfbe714ffc6073dcc00bc
-
C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\4f17dd82-a770-40a6-8753-4733de19a30d\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/904-119-0x00000000060F0000-0x00000000060F1000-memory.dmpFilesize
4KB
-
memory/904-118-0x0000000005B60000-0x0000000005BF0000-memory.dmpFilesize
576KB
-
memory/904-114-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/904-117-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/904-116-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/1196-120-0x0000000000000000-mapping.dmp
-
memory/1520-140-0x0000000008420000-0x0000000008421000-memory.dmpFilesize
4KB
-
memory/1520-150-0x00000000094D0000-0x0000000009503000-memory.dmpFilesize
204KB
-
memory/1520-136-0x0000000007670000-0x0000000007671000-memory.dmpFilesize
4KB
-
memory/1520-135-0x0000000004E02000-0x0000000004E03000-memory.dmpFilesize
4KB
-
memory/1520-134-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/1520-164-0x0000000009A30000-0x0000000009A31000-memory.dmpFilesize
4KB
-
memory/1520-204-0x0000000004E03000-0x0000000004E04000-memory.dmpFilesize
4KB
-
memory/1520-138-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB
-
memory/1520-129-0x00000000077C0000-0x00000000077C1000-memory.dmpFilesize
4KB
-
memory/1520-128-0x0000000003430000-0x0000000003431000-memory.dmpFilesize
4KB
-
memory/1520-139-0x0000000007FD0000-0x0000000007FD1000-memory.dmpFilesize
4KB
-
memory/1520-125-0x0000000000000000-mapping.dmp
-
memory/1520-163-0x000000007EE90000-0x000000007EE91000-memory.dmpFilesize
4KB
-
memory/1520-141-0x0000000008770000-0x0000000008771000-memory.dmpFilesize
4KB
-
memory/1520-142-0x0000000008680000-0x0000000008681000-memory.dmpFilesize
4KB
-
memory/1520-358-0x00000000072F0000-0x00000000072F1000-memory.dmpFilesize
4KB
-
memory/1520-137-0x0000000007F60000-0x0000000007F61000-memory.dmpFilesize
4KB
-
memory/1520-157-0x00000000094B0000-0x00000000094B1000-memory.dmpFilesize
4KB
-
memory/1520-162-0x0000000009810000-0x0000000009811000-memory.dmpFilesize
4KB
-
memory/1520-364-0x00000000072E0000-0x00000000072E1000-memory.dmpFilesize
4KB
-
memory/1552-123-0x0000000000000000-mapping.dmp
-
memory/2572-130-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2572-131-0x000000000043760E-mapping.dmp