Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe
Resource
win10v2004-20220414-en
General
-
Target
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe
-
Size
14KB
-
MD5
e227e1d49bbac2b778e5b3a6be7842af
-
SHA1
9adc12e74740325133052da2cdb991729f777cfb
-
SHA256
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6
-
SHA512
20872cf0464d2ef313df9e56c4cfc7ca9fa69719c83433efb71da391f22298366f160acc678e25d638f872f549454e28bb0ddabe6b04ef2381de5a8bbfa722cd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.execf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exedescription ioc process File opened for modification \??\PhysicalDrive0 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\061e0e5f-9c18-4f3c-8025-50404ef6bb2a.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220520230433.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.execf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.execf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.execf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.execf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exepid process 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4556 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1664 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 1772 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 3388 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe 4744 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
Processes:
msedge.exepid process 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 2980 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2980 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exepid process 3040 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.execf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exemsedge.exedescription pid process target process PID 3164 wrote to memory of 1664 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 1664 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 1664 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 1772 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 1772 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 1772 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 4744 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 4744 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 4744 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 3388 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 3388 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 3388 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 4556 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 4556 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 4556 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 3040 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 3040 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3164 wrote to memory of 3040 3164 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe PID 3040 wrote to memory of 804 3040 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe notepad.exe PID 3040 wrote to memory of 804 3040 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe notepad.exe PID 3040 wrote to memory of 804 3040 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe notepad.exe PID 3040 wrote to memory of 4680 3040 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe msedge.exe PID 3040 wrote to memory of 4680 3040 cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe msedge.exe PID 4680 wrote to memory of 4604 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 4604 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe PID 4680 wrote to memory of 916 4680 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe"C:\Users\Admin\AppData\Local\Temp\cf030610e098289e2368c6ff1f3a475e5ab42b5ce6e5813f99b103347f2330e6.exe" /main2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaaa9f46f8,0x7ffaaa9f4708,0x7ffaaa9f47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5564 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3872 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7908f5460,0x7ff7908f5470,0x7ff7908f54805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6296 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4088 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4006986806386003222,12106865871944971622,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaaa9f46f8,0x7ffaaa9f4708,0x7ffaaa9f47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaaa9f46f8,0x7ffaaa9f4708,0x7ffaaa9f47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaaa9f46f8,0x7ffaaa9f4708,0x7ffaaa9f47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaaa9f46f8,0x7ffaaa9f4708,0x7ffaaa9f47184⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x518 0x2f81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c8ce7285f4bd4ade99ffd08c0351e308
SHA1c3de927f710893a2821e9ade59c80cbaab3b6e12
SHA256d434784b824ab0d1279c8d37b95219c3b9de8840827d9fb08e4f22a9022ef297
SHA5127a958b60031dc96e7212be39dd999193029089992f0ed6c95e299f6914b6cfd5f126d9c98121c1f316b51f3e6806785cceaafa1e3d6c9bd317e7a858ff3f0646
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c8ce7285f4bd4ade99ffd08c0351e308
SHA1c3de927f710893a2821e9ade59c80cbaab3b6e12
SHA256d434784b824ab0d1279c8d37b95219c3b9de8840827d9fb08e4f22a9022ef297
SHA5127a958b60031dc96e7212be39dd999193029089992f0ed6c95e299f6914b6cfd5f126d9c98121c1f316b51f3e6806785cceaafa1e3d6c9bd317e7a858ff3f0646
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c8ce7285f4bd4ade99ffd08c0351e308
SHA1c3de927f710893a2821e9ade59c80cbaab3b6e12
SHA256d434784b824ab0d1279c8d37b95219c3b9de8840827d9fb08e4f22a9022ef297
SHA5127a958b60031dc96e7212be39dd999193029089992f0ed6c95e299f6914b6cfd5f126d9c98121c1f316b51f3e6806785cceaafa1e3d6c9bd317e7a858ff3f0646
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c8ce7285f4bd4ade99ffd08c0351e308
SHA1c3de927f710893a2821e9ade59c80cbaab3b6e12
SHA256d434784b824ab0d1279c8d37b95219c3b9de8840827d9fb08e4f22a9022ef297
SHA5127a958b60031dc96e7212be39dd999193029089992f0ed6c95e299f6914b6cfd5f126d9c98121c1f316b51f3e6806785cceaafa1e3d6c9bd317e7a858ff3f0646
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
\??\pipe\LOCAL\crashpad_4680_MYVCXKMLNDNDFGPNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/668-194-0x0000000000000000-mapping.dmp
-
memory/804-136-0x0000000000000000-mapping.dmp
-
memory/916-141-0x0000000000000000-mapping.dmp
-
memory/1044-167-0x0000000000000000-mapping.dmp
-
memory/1384-164-0x0000000000000000-mapping.dmp
-
memory/1420-192-0x0000000000000000-mapping.dmp
-
memory/1532-142-0x0000000000000000-mapping.dmp
-
memory/1664-130-0x0000000000000000-mapping.dmp
-
memory/1772-131-0x0000000000000000-mapping.dmp
-
memory/1796-170-0x0000000000000000-mapping.dmp
-
memory/2004-176-0x0000000000000000-mapping.dmp
-
memory/2020-144-0x0000000000000000-mapping.dmp
-
memory/2172-185-0x0000000000000000-mapping.dmp
-
memory/2240-151-0x0000000000000000-mapping.dmp
-
memory/2308-153-0x0000000000000000-mapping.dmp
-
memory/2372-169-0x0000000000000000-mapping.dmp
-
memory/2576-178-0x0000000000000000-mapping.dmp
-
memory/2708-181-0x0000000000000000-mapping.dmp
-
memory/2812-149-0x0000000000000000-mapping.dmp
-
memory/3040-135-0x0000000000000000-mapping.dmp
-
memory/3080-174-0x0000000000000000-mapping.dmp
-
memory/3104-157-0x0000000000000000-mapping.dmp
-
memory/3124-159-0x0000000000000000-mapping.dmp
-
memory/3136-163-0x0000000000000000-mapping.dmp
-
memory/3388-133-0x0000000000000000-mapping.dmp
-
memory/3536-160-0x0000000000000000-mapping.dmp
-
memory/3548-171-0x0000000000000000-mapping.dmp
-
memory/3548-162-0x0000000000000000-mapping.dmp
-
memory/3652-188-0x0000000000000000-mapping.dmp
-
memory/3964-161-0x0000000000000000-mapping.dmp
-
memory/4132-187-0x0000000000000000-mapping.dmp
-
memory/4492-189-0x0000000000000000-mapping.dmp
-
memory/4500-155-0x0000000000000000-mapping.dmp
-
memory/4556-134-0x0000000000000000-mapping.dmp
-
memory/4596-177-0x0000000000000000-mapping.dmp
-
memory/4604-139-0x0000000000000000-mapping.dmp
-
memory/4680-138-0x0000000000000000-mapping.dmp
-
memory/4744-132-0x0000000000000000-mapping.dmp
-
memory/4840-147-0x0000000000000000-mapping.dmp
-
memory/5040-183-0x0000000000000000-mapping.dmp