Analysis
-
max time kernel
160s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2022 07:21
Static task
static1
Behavioral task
behavioral1
Sample
0437918badc36e49aec44d6b07dea2ab.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
0437918badc36e49aec44d6b07dea2ab.exe
Resource
win10v2004-20220721-en
General
-
Target
0437918badc36e49aec44d6b07dea2ab.exe
-
Size
1.4MB
-
MD5
0437918badc36e49aec44d6b07dea2ab
-
SHA1
6ed87877260a6f566f1aa8fd6d9edcc26b3c8815
-
SHA256
1d4954ca060b4eaec6ae327a5c7ab379ea6892b591858d0d03de67ccd87de996
-
SHA512
918186ff02884996dfb1c902e8c32e807f1dc34ce6f4424e6864a5043c987e55bb411ce811192dbafac471992e666027de1541fa895d9948f90ecedca567ce45
Malware Config
Extracted
redline
nam3
103.89.90.61:18728
-
auth_value
64b900120bbceaa6a9c60e9079492895
Extracted
redline
4
31.41.244.134:11643
-
auth_value
a516b2d034ecd34338f12b50347fbd92
Extracted
redline
@tag12312341
62.204.41.144:14096
-
auth_value
71466795417275fac01979e57016e277
Extracted
redline
https://t.me/insttailer
185.199.224.90:37143
-
auth_value
1e73e022970e3ad55c62cb5010e7599b
Extracted
raccoon
27f434caa92497d1b6f4b36154ae9141
http://45.182.189.196/
Extracted
raccoon
315dc1dd84dd7b872ce61c63b12c8944
http://146.19.247.91/
Extracted
redline
5076357887
185.87.149.167:31402
-
auth_value
0dfaff60271d374d0c206d19883e06f3
Extracted
privateloader
http://163.123.143.4/proxies.txt
http://193.233.177.215/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
163.123.143.12
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Raccoon Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3124-260-0x0000000000400000-0x0000000000522000-memory.dmp family_raccoon behavioral2/memory/3124-257-0x00000000021E0000-0x00000000021F5000-memory.dmp family_raccoon behavioral2/memory/1848-254-0x00000000006B0000-0x00000000006BE000-memory.dmp family_raccoon behavioral2/memory/1848-263-0x0000000000400000-0x0000000000454000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 14 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline behavioral2/memory/1320-168-0x0000000000360000-0x00000000003A4000-memory.dmp family_redline behavioral2/memory/2080-171-0x0000000000730000-0x0000000000774000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\tag.exe family_redline C:\Program Files (x86)\Company\NewProduct\tag.exe family_redline behavioral2/memory/4980-175-0x0000000000070000-0x0000000000090000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline behavioral2/memory/900-197-0x0000000000C20000-0x0000000000C50000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe family_redline C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe family_redline C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline behavioral2/memory/7416-293-0x00000000009F0000-0x0000000000A10000-memory.dmp family_redline -
Executes dropped EXE 13 IoCs
Processes:
real.exeF0geI.exenamdoitntn.exeromb_ro.exesafert44.exetag.exekukurzka9000.exeffnameedit.exenamdoitntn.exeg3rgg.exejshainx.exeme.exemsedgerecovery.exepid process 3020 real.exe 1848 F0geI.exe 1320 namdoitntn.exe 2040 romb_ro.exe 2080 safert44.exe 4980 tag.exe 3124 kukurzka9000.exe 900 ffnameedit.exe 1812 namdoitntn.exe 5480 g3rgg.exe 7416 jshainx.exe 7520 me.exe 8136 msedgerecovery.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0437918badc36e49aec44d6b07dea2ab.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 0437918badc36e49aec44d6b07dea2ab.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 18 IoCs
Processes:
0437918badc36e49aec44d6b07dea2ab.exesetup.exeelevation_service.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jshainx.exe 0437918badc36e49aec44d6b07dea2ab.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3d4d69c6-26cd-45e3-9276-28d15e82d7fe.tmp setup.exe File created C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\MicrosoftEdgeUpdateSetup.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\msedgerecovery.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\recovery-component-inner.crx elevation_service.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\romb_ro.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\me.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220812092153.pma setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\MicrosoftEdgeUpdateSetup.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\tag.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe 0437918badc36e49aec44d6b07dea2ab.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\g3rgg.exe 0437918badc36e49aec44d6b07dea2ab.exe File created C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\msedgerecovery.exe elevation_service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 7132 1848 WerFault.exe F0geI.exe 7288 2040 WerFault.exe romb_ro.exe 5844 5480 WerFault.exe g3rgg.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
romb_ro.exereal.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 romb_ro.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString romb_ro.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 real.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString real.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeromb_ro.exetag.exereal.exeidentity_helper.exemsedge.exepid process 5328 msedge.exe 5328 msedge.exe 5364 msedge.exe 5364 msedge.exe 5340 msedge.exe 5340 msedge.exe 5352 msedge.exe 5352 msedge.exe 5312 msedge.exe 5312 msedge.exe 5272 msedge.exe 5272 msedge.exe 5456 msedge.exe 5456 msedge.exe 4304 msedge.exe 4304 msedge.exe 2040 romb_ro.exe 2040 romb_ro.exe 4980 tag.exe 4980 tag.exe 3020 real.exe 3020 real.exe 7580 identity_helper.exe 7580 identity_helper.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
Processes:
msedge.exepid process 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tag.exedescription pid process Token: SeDebugPrivilege 4980 tag.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0437918badc36e49aec44d6b07dea2ab.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription pid process target process PID 1884 wrote to memory of 1964 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 1964 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 3528 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 3528 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1964 wrote to memory of 624 1964 msedge.exe msedge.exe PID 1964 wrote to memory of 624 1964 msedge.exe msedge.exe PID 1884 wrote to memory of 2200 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 2200 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 3528 wrote to memory of 2324 3528 msedge.exe msedge.exe PID 3528 wrote to memory of 2324 3528 msedge.exe msedge.exe PID 2200 wrote to memory of 4776 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4776 2200 msedge.exe msedge.exe PID 1884 wrote to memory of 1064 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 1064 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1064 wrote to memory of 4764 1064 msedge.exe msedge.exe PID 1064 wrote to memory of 4764 1064 msedge.exe msedge.exe PID 1884 wrote to memory of 4304 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 4304 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 4304 wrote to memory of 2824 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 2824 4304 msedge.exe msedge.exe PID 1884 wrote to memory of 4852 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 4852 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 4852 wrote to memory of 4956 4852 msedge.exe msedge.exe PID 4852 wrote to memory of 4956 4852 msedge.exe msedge.exe PID 1884 wrote to memory of 212 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 1884 wrote to memory of 212 1884 0437918badc36e49aec44d6b07dea2ab.exe msedge.exe PID 212 wrote to memory of 1332 212 msedge.exe msedge.exe PID 212 wrote to memory of 1332 212 msedge.exe msedge.exe PID 1884 wrote to memory of 3020 1884 0437918badc36e49aec44d6b07dea2ab.exe real.exe PID 1884 wrote to memory of 3020 1884 0437918badc36e49aec44d6b07dea2ab.exe real.exe PID 1884 wrote to memory of 3020 1884 0437918badc36e49aec44d6b07dea2ab.exe real.exe PID 1884 wrote to memory of 1848 1884 0437918badc36e49aec44d6b07dea2ab.exe F0geI.exe PID 1884 wrote to memory of 1848 1884 0437918badc36e49aec44d6b07dea2ab.exe F0geI.exe PID 1884 wrote to memory of 1848 1884 0437918badc36e49aec44d6b07dea2ab.exe F0geI.exe PID 1884 wrote to memory of 1320 1884 0437918badc36e49aec44d6b07dea2ab.exe namdoitntn.exe PID 1884 wrote to memory of 1320 1884 0437918badc36e49aec44d6b07dea2ab.exe namdoitntn.exe PID 1884 wrote to memory of 1320 1884 0437918badc36e49aec44d6b07dea2ab.exe namdoitntn.exe PID 1884 wrote to memory of 2040 1884 0437918badc36e49aec44d6b07dea2ab.exe romb_ro.exe PID 1884 wrote to memory of 2040 1884 0437918badc36e49aec44d6b07dea2ab.exe romb_ro.exe PID 1884 wrote to memory of 2040 1884 0437918badc36e49aec44d6b07dea2ab.exe romb_ro.exe PID 1884 wrote to memory of 2080 1884 0437918badc36e49aec44d6b07dea2ab.exe safert44.exe PID 1884 wrote to memory of 2080 1884 0437918badc36e49aec44d6b07dea2ab.exe safert44.exe PID 1884 wrote to memory of 2080 1884 0437918badc36e49aec44d6b07dea2ab.exe safert44.exe PID 1884 wrote to memory of 4980 1884 0437918badc36e49aec44d6b07dea2ab.exe tag.exe PID 1884 wrote to memory of 4980 1884 0437918badc36e49aec44d6b07dea2ab.exe tag.exe PID 1884 wrote to memory of 4980 1884 0437918badc36e49aec44d6b07dea2ab.exe tag.exe PID 1884 wrote to memory of 3124 1884 0437918badc36e49aec44d6b07dea2ab.exe kukurzka9000.exe PID 1884 wrote to memory of 3124 1884 0437918badc36e49aec44d6b07dea2ab.exe kukurzka9000.exe PID 1884 wrote to memory of 3124 1884 0437918badc36e49aec44d6b07dea2ab.exe kukurzka9000.exe PID 1884 wrote to memory of 900 1884 0437918badc36e49aec44d6b07dea2ab.exe ffnameedit.exe PID 1884 wrote to memory of 900 1884 0437918badc36e49aec44d6b07dea2ab.exe ffnameedit.exe PID 1884 wrote to memory of 900 1884 0437918badc36e49aec44d6b07dea2ab.exe ffnameedit.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe PID 4304 wrote to memory of 4820 4304 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0437918badc36e49aec44d6b07dea2ab.exe"C:\Users\Admin\AppData\Local\Temp\0437918badc36e49aec44d6b07dea2ab.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1n7LH42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9328787992473450755,8336763830684849298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9328787992473450755,8336763830684849298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xb0,0x104,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,660440899189769028,6892335883501700629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,660440899189769028,6892335883501700629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10250367741659876535,14849836629650154608,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10250367741659876535,14849836629650154608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4152686119374878134,3619716638069214854,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4152686119374878134,3619716638069214854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX42⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6908 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6d29f5460,0x7ff6d29f5470,0x7ff6d29f54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8100 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2476 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2208,2018863653569887703,10862131666498195371,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5928 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RchC42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8245981265603171376,7172657473434608961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8245981265603171376,7172657473434608961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3372337498497149511,3135868774950129064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3372337498497149511,3135868774950129064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\real.exe"C:\Program Files (x86)\Company\NewProduct\real.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exe"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 5643⤵
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\romb_ro.exe"C:\Program Files (x86)\Company\NewProduct\romb_ro.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 13363⤵
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\safert44.exe"C:\Program Files (x86)\Company\NewProduct\safert44.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\tag.exe"C:\Program Files (x86)\Company\NewProduct\tag.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\g3rgg.exe"C:\Program Files (x86)\Company\NewProduct\g3rgg.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 6163⤵
- Program crash
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RqCC42⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nNrK42⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nzwK42⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247183⤵
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exe"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\me.exe"C:\Program Files (x86)\Company\NewProduct\me.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf9e246f8,0x7ffdf9e24708,0x7ffdf9e247181⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1848 -ip 18481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2040 -ip 20401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5480 -ip 54801⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\msedgerecovery.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={5dcef750-0b30-4fe9-a8f5-b9735c5d0059} --system2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\MicrosoftEdgeUpdateSetup.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir7576_1624885591\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
290KB
MD58ab8fc20b7ab8b18bf0f474cc0156523
SHA121b922f6dcd49b67b5b3abc9603ec90835e7a20d
SHA256b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca
SHA512ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
290KB
MD58ab8fc20b7ab8b18bf0f474cc0156523
SHA121b922f6dcd49b67b5b3abc9603ec90835e7a20d
SHA256b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca
SHA512ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2
-
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exeFilesize
173KB
MD5c5acc7e661db592ec6208d6147d5b165
SHA1642f9ab10434a77ed016921401c9361b1bb36639
SHA25698169ab9ee35cdca15321683fe25378988a02350c9c09236d022c1202714fa4d
SHA51292f06ee866222d47496d43ac4228e43aad2886c1a6195015d6ffa40f95fef2f803f2754e4efe620fde60808cb55a42e5c9a294098718d63f419a2e282d912161
-
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exeFilesize
173KB
MD5c5acc7e661db592ec6208d6147d5b165
SHA1642f9ab10434a77ed016921401c9361b1bb36639
SHA25698169ab9ee35cdca15321683fe25378988a02350c9c09236d022c1202714fa4d
SHA51292f06ee866222d47496d43ac4228e43aad2886c1a6195015d6ffa40f95fef2f803f2754e4efe620fde60808cb55a42e5c9a294098718d63f419a2e282d912161
-
C:\Program Files (x86)\Company\NewProduct\g3rgg.exeFilesize
386KB
MD559be2ebcf6516dd07ee5df8eae402523
SHA1e4e5b949a0c9721e4c89f124750d8a97e4d96c7e
SHA256d2952be5c81f4135c0953b7b36677704f24f4d780de268ce6b67a44a6f15419a
SHA5129148e9a303a3562f9552da8fa6cdd3c1d4034be31d20968a8dc51904c0d4cf167c0cdfa0d6ceac0ec0a24a975b8c04de9a1d4d67f0056dce810ad4e5b83215d2
-
C:\Program Files (x86)\Company\NewProduct\g3rgg.exeFilesize
386KB
MD559be2ebcf6516dd07ee5df8eae402523
SHA1e4e5b949a0c9721e4c89f124750d8a97e4d96c7e
SHA256d2952be5c81f4135c0953b7b36677704f24f4d780de268ce6b67a44a6f15419a
SHA5129148e9a303a3562f9552da8fa6cdd3c1d4034be31d20968a8dc51904c0d4cf167c0cdfa0d6ceac0ec0a24a975b8c04de9a1d4d67f0056dce810ad4e5b83215d2
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
1.1MB
MD5b0d7a19c257498a2ddf4ff73a9b6fbcf
SHA107233b967c956c3cfd5498c2db6a2251769704ff
SHA25645bb46dc46d924cba64dfb24d80656a9e11c0d83d506431c86ddc58e3487b1f3
SHA51260ed892b712b69befb78138cc096a6cb17d367cd1a2e6ab9010d485d9e583aff226aff67cf23d04170bbbd679652ed03ec72cdd67507db8450dab3fc9ecd7147
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
1.1MB
MD5b0d7a19c257498a2ddf4ff73a9b6fbcf
SHA107233b967c956c3cfd5498c2db6a2251769704ff
SHA25645bb46dc46d924cba64dfb24d80656a9e11c0d83d506431c86ddc58e3487b1f3
SHA51260ed892b712b69befb78138cc096a6cb17d367cd1a2e6ab9010d485d9e583aff226aff67cf23d04170bbbd679652ed03ec72cdd67507db8450dab3fc9ecd7147
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
245KB
MD5b16134159e66a72fb36d93bc703b4188
SHA1e869e91a2b0f77e7ac817e0b30a9a23d537b3001
SHA256b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c
SHA5123fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
245KB
MD5b16134159e66a72fb36d93bc703b4188
SHA1e869e91a2b0f77e7ac817e0b30a9a23d537b3001
SHA256b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c
SHA5123fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
245KB
MD5b16134159e66a72fb36d93bc703b4188
SHA1e869e91a2b0f77e7ac817e0b30a9a23d537b3001
SHA256b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c
SHA5123fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
289KB
MD5cf25b95144c2766ff8d6af9439b77596
SHA1467cfb3e63b9da2b1c03bc712ab08cdb8fa71034
SHA256df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c
SHA512bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
289KB
MD5cf25b95144c2766ff8d6af9439b77596
SHA1467cfb3e63b9da2b1c03bc712ab08cdb8fa71034
SHA256df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c
SHA512bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d
-
C:\Program Files (x86)\Company\NewProduct\romb_ro.exeFilesize
289KB
MD5e699a82cef03ea485495a78f74af733d
SHA1c5d3719a8a05f27e4f733294b8b89838f204fc64
SHA256206104c8b944adca4068bf6d7c89fb28c68884f63d013f7dd0f67270a8220b97
SHA512887c81ef11f4c4b5d4e135e9b6d740ce1cbfce873302c0ef80ae636492ff53a763b4ea7ad961c2bbc8b967de7a78e3ac8d3965acb679fbf69dd396466c0950a0
-
C:\Program Files (x86)\Company\NewProduct\romb_ro.exeFilesize
289KB
MD5e699a82cef03ea485495a78f74af733d
SHA1c5d3719a8a05f27e4f733294b8b89838f204fc64
SHA256206104c8b944adca4068bf6d7c89fb28c68884f63d013f7dd0f67270a8220b97
SHA512887c81ef11f4c4b5d4e135e9b6d740ce1cbfce873302c0ef80ae636492ff53a763b4ea7ad961c2bbc8b967de7a78e3ac8d3965acb679fbf69dd396466c0950a0
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
244KB
MD5dbe947674ea388b565ae135a09cc6638
SHA1ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA25686aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA51267441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
244KB
MD5dbe947674ea388b565ae135a09cc6638
SHA1ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA25686aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA51267441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
-
C:\Program Files (x86)\Company\NewProduct\tag.exeFilesize
107KB
MD52ebc22860c7d9d308c018f0ffb5116ff
SHA178791a83f7161e58f9b7df45f9be618e9daea4cd
SHA2568e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
-
C:\Program Files (x86)\Company\NewProduct\tag.exeFilesize
107KB
MD52ebc22860c7d9d308c018f0ffb5116ff
SHA178791a83f7161e58f9b7df45f9be618e9daea4cd
SHA2568e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539d33ed8e39d48cbbe10137b840a938a
SHA1af463ffd0fe9508fb7c71585709eaada860626bc
SHA256d2dd2e1482b5a8808b7a88a8979fa6ad2ded1a99a0b6c83ddcc3004261d01451
SHA51218c96d2add074aaa3dd470ba01f104be0f107d51417bc8c8a609f69a444e598049b3fbe4d2a84f29b7e59e0aa5de474655735418d2838e8efe20aa675b96f6bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c4f48398fdb31b8bd84eadac9ddf5acc
SHA156bc7ec79f71a6f609e12c1c8ca68c9a83c352e5
SHA2568acec190b9fa36a48e95fa130737ceb06cb498c771ff6874ebc47da5825d1746
SHA51216b756eae47dae99f48803625c7a0c30e306a76c27578c829cccf32c9cb52df0aea32bc92d07c7b18fe249cf4fa443e2365d07f0bec4bf47f97af762b7ab3b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
112KB
MD530e375798049100677ea16b7c578a4ee
SHA1bcab7401a5f34ac0e6f795ece8d3ed12944ae99f
SHA256ea5c90cfc97f429a2f9e0b1e9b16778b5b19bd8e83a896a30002de70af84e1ce
SHA512f8ae930e26ecfe06dc30d4f39858b0eec6b4a81a8139883712505b5c6b58504d463d986ef58c7151a247fe157c6013b570b9d39e1d4a860061e37e0419900582
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD54cfb5feb4befaa28f3b4779e2d55720b
SHA10f3d700d326f665c90d5a458ecef42ce3fe692f1
SHA2567fc8e93c76b1032661abc3c3fbb5ce0bc8375c953196c6b65d8833414bbfcc2d
SHA5124614f078626669f6cf7f6d09bf2973907b4820423ecd7ade83118ad1717bc73b5dc0f3dff4abfa139c29e1739c6af1ebc4fefb851f74a058f3a7a9e5548c1586
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5d931c5c6767aae1e5d0a179320bf91bb
SHA1414d141680a99cd9fcd0139f6ffafc4b8163a054
SHA2566f8d60ed76c2f1a7cfed80b3fd07d266d6cdbb6e1305f1dfaf09f44d90bf6ffc
SHA512b6520b7c31f668944d878426cfaab3cd11968b2236beeee86e834ccaa41bc1da2ff90c8b004a6f338977bdbe107022b883b25d9a4e60ec680b5a37667af6041c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD561ddb5d2734b30736534dcc4876d28bb
SHA1bd8fc7a261551c53bd606428227f12f8970eef41
SHA256a4381816a2574c1377b1d567d94f830ad2efc11c3ed5e57ab6ff165f87b289cf
SHA512d80c23ca83867ff2e72033cb88f62ad8c98ecf99a3c3c648bf97a0952932b6f240821bd332ea1744a6f7cbd04b53a6618a5a891acca4a5836cf782b83bd95287
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD579887d3fa663598e4a7f41fd02b948cf
SHA159ead39a5b385fb880a735d2e94d71cda9bd6513
SHA2561ffd4671c6a0bdd058d283bdecaaafcbd264a38b90bfb93d4613936c93f5d911
SHA5120f7422fcb59f293328a3048e06371d05a9e8629216a39cd98466d7cd1170b59eae800ec19161d3219a188fddc46f97d70774974d36803b0cb7de19338f7b57ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5115e842066d53a49acf1d4fb0db89e46
SHA172c9e15489c25c63286a54e06507904af6e6ddd1
SHA25646396beb2e471816b7d596d9b43a9b5b45d88438ab5c4314d1ff6f35ccfee5b4
SHA5120619377bd5d1b81dbed429563429600d860367861ab27a833abb997cf5b8ccffd9768708962d9c01a3861fe172f18f15867cd6e62b59065ccb99ac6b6ded21d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD54cfb5feb4befaa28f3b4779e2d55720b
SHA10f3d700d326f665c90d5a458ecef42ce3fe692f1
SHA2567fc8e93c76b1032661abc3c3fbb5ce0bc8375c953196c6b65d8833414bbfcc2d
SHA5124614f078626669f6cf7f6d09bf2973907b4820423ecd7ade83118ad1717bc73b5dc0f3dff4abfa139c29e1739c6af1ebc4fefb851f74a058f3a7a9e5548c1586
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5cec4a90dced8509fdb05b23026a89364
SHA117a8927398da71efe03e74b86a635c64f2cf7b46
SHA2562b3dc3b93e34c36b62c625cbeb93c29b6559082b700453b75075825001cf69bd
SHA512ef778f826d5068a2ff2b287b796d3181383a47ef77909e04a0e0fdce3514295c6ad0c8931c64b36876cc270ad46e7dfce99d326566ee47e4abc2b088f664b964
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD579887d3fa663598e4a7f41fd02b948cf
SHA159ead39a5b385fb880a735d2e94d71cda9bd6513
SHA2561ffd4671c6a0bdd058d283bdecaaafcbd264a38b90bfb93d4613936c93f5d911
SHA5120f7422fcb59f293328a3048e06371d05a9e8629216a39cd98466d7cd1170b59eae800ec19161d3219a188fddc46f97d70774974d36803b0cb7de19338f7b57ab
-
\??\pipe\LOCAL\crashpad_1064_WOENQKNTKUNGMJCXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_1964_RUERNHESGIUQFWNJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_212_ABICOXPRESRFGWWAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_2200_EWHQFFOJKZNVNRGAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_3528_QCFPVMITQWJKMAQGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4304_WFRMCCGJFDOMQXZUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4852_PUQTJDFAOOLSDAJVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/212-146-0x0000000000000000-mapping.dmp
-
memory/624-132-0x0000000000000000-mapping.dmp
-
memory/900-197-0x0000000000C20000-0x0000000000C50000-memory.dmpFilesize
192KB
-
memory/900-181-0x0000000000000000-mapping.dmp
-
memory/1064-138-0x0000000000000000-mapping.dmp
-
memory/1320-168-0x0000000000360000-0x00000000003A4000-memory.dmpFilesize
272KB
-
memory/1320-156-0x0000000000000000-mapping.dmp
-
memory/1332-148-0x0000000000000000-mapping.dmp
-
memory/1812-192-0x0000000000000000-mapping.dmp
-
memory/1848-263-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1848-153-0x0000000000000000-mapping.dmp
-
memory/1848-252-0x0000000000799000-0x00000000007A9000-memory.dmpFilesize
64KB
-
memory/1848-254-0x00000000006B0000-0x00000000006BE000-memory.dmpFilesize
56KB
-
memory/1852-310-0x0000000000000000-mapping.dmp
-
memory/1964-130-0x0000000000000000-mapping.dmp
-
memory/2040-235-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/2040-158-0x0000000000000000-mapping.dmp
-
memory/2080-209-0x00000000050F0000-0x0000000005102000-memory.dmpFilesize
72KB
-
memory/2080-171-0x0000000000730000-0x0000000000774000-memory.dmpFilesize
272KB
-
memory/2080-166-0x0000000000000000-mapping.dmp
-
memory/2080-233-0x0000000005150000-0x000000000518C000-memory.dmpFilesize
240KB
-
memory/2200-133-0x0000000000000000-mapping.dmp
-
memory/2324-134-0x0000000000000000-mapping.dmp
-
memory/2496-200-0x0000000000000000-mapping.dmp
-
memory/2708-242-0x0000000000000000-mapping.dmp
-
memory/2824-142-0x0000000000000000-mapping.dmp
-
memory/3020-150-0x0000000000000000-mapping.dmp
-
memory/3124-260-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/3124-257-0x00000000021E0000-0x00000000021F5000-memory.dmpFilesize
84KB
-
memory/3124-178-0x0000000000000000-mapping.dmp
-
memory/3176-333-0x0000000000000000-mapping.dmp
-
memory/3528-131-0x0000000000000000-mapping.dmp
-
memory/4304-140-0x0000000000000000-mapping.dmp
-
memory/4448-332-0x0000000000000000-mapping.dmp
-
memory/4764-139-0x0000000000000000-mapping.dmp
-
memory/4776-135-0x0000000000000000-mapping.dmp
-
memory/4820-199-0x0000000000000000-mapping.dmp
-
memory/4852-144-0x0000000000000000-mapping.dmp
-
memory/4956-145-0x0000000000000000-mapping.dmp
-
memory/4980-300-0x00000000058D0000-0x0000000005946000-memory.dmpFilesize
472KB
-
memory/4980-301-0x0000000005990000-0x00000000059AE000-memory.dmpFilesize
120KB
-
memory/4980-175-0x0000000000070000-0x0000000000090000-memory.dmpFilesize
128KB
-
memory/4980-206-0x0000000004E80000-0x0000000005498000-memory.dmpFilesize
6.1MB
-
memory/4980-299-0x00000000054A0000-0x0000000005506000-memory.dmpFilesize
408KB
-
memory/4980-218-0x00000000049F0000-0x0000000004AFA000-memory.dmpFilesize
1.0MB
-
memory/4980-298-0x0000000004D90000-0x0000000004E22000-memory.dmpFilesize
584KB
-
memory/4980-297-0x0000000005A50000-0x0000000005FF4000-memory.dmpFilesize
5.6MB
-
memory/4980-305-0x0000000006510000-0x00000000066D2000-memory.dmpFilesize
1.8MB
-
memory/4980-306-0x0000000006C10000-0x000000000713C000-memory.dmpFilesize
5.2MB
-
memory/4980-334-0x0000000006B70000-0x0000000006BC0000-memory.dmpFilesize
320KB
-
memory/4980-167-0x0000000000000000-mapping.dmp
-
memory/5132-201-0x0000000000000000-mapping.dmp
-
memory/5144-202-0x0000000000000000-mapping.dmp
-
memory/5156-203-0x0000000000000000-mapping.dmp
-
memory/5172-204-0x0000000000000000-mapping.dmp
-
memory/5208-205-0x0000000000000000-mapping.dmp
-
memory/5272-207-0x0000000000000000-mapping.dmp
-
memory/5312-210-0x0000000000000000-mapping.dmp
-
memory/5328-211-0x0000000000000000-mapping.dmp
-
memory/5340-212-0x0000000000000000-mapping.dmp
-
memory/5352-213-0x0000000000000000-mapping.dmp
-
memory/5364-214-0x0000000000000000-mapping.dmp
-
memory/5456-215-0x0000000000000000-mapping.dmp
-
memory/5468-220-0x0000000000000000-mapping.dmp
-
memory/5480-336-0x0000000000588000-0x00000000005AE000-memory.dmpFilesize
152KB
-
memory/5480-304-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/5480-302-0x0000000000588000-0x00000000005AE000-memory.dmpFilesize
152KB
-
memory/5480-339-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/5480-337-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/5480-217-0x0000000000000000-mapping.dmp
-
memory/5480-338-0x0000000000588000-0x00000000005AE000-memory.dmpFilesize
152KB
-
memory/5480-303-0x0000000002090000-0x00000000020E9000-memory.dmpFilesize
356KB
-
memory/6012-238-0x0000000000000000-mapping.dmp
-
memory/6256-277-0x0000000000000000-mapping.dmp
-
memory/6764-259-0x0000000000000000-mapping.dmp
-
memory/6812-283-0x0000000000000000-mapping.dmp
-
memory/6816-264-0x0000000000000000-mapping.dmp
-
memory/6832-279-0x0000000000000000-mapping.dmp
-
memory/6856-265-0x0000000000000000-mapping.dmp
-
memory/6868-280-0x0000000000000000-mapping.dmp
-
memory/6884-281-0x0000000000000000-mapping.dmp
-
memory/7048-269-0x0000000000000000-mapping.dmp
-
memory/7160-285-0x0000000000000000-mapping.dmp
-
memory/7192-287-0x0000000000000000-mapping.dmp
-
memory/7232-312-0x0000000000000000-mapping.dmp
-
memory/7268-289-0x0000000000000000-mapping.dmp
-
memory/7304-290-0x0000000000000000-mapping.dmp
-
memory/7392-291-0x0000000000000000-mapping.dmp
-
memory/7416-292-0x0000000000000000-mapping.dmp
-
memory/7416-293-0x00000000009F0000-0x0000000000A10000-memory.dmpFilesize
128KB
-
memory/7520-294-0x0000000000000000-mapping.dmp
-
memory/7572-296-0x0000000000000000-mapping.dmp
-
memory/7580-335-0x0000000000000000-mapping.dmp
-
memory/8020-308-0x0000000000000000-mapping.dmp