privateloader | be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0

Analysis

max time kernel
299s
max time network
290s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
13-08-2022 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
Size

1.3MB
MD5

c0ea08a163298e0493d9cb9d9f6881d1
SHA1

bb69cd93645a2cb1a0629fbfe5314d6774c31f0d
SHA256

be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0
SHA512

38518baaba5372f97ac22ed3576fd50c63a883480195b2bc4d480f036bf5850a4dfd232a248043fb8b50c89eb6d3b69eeb07361341e259b596e93a97f0077291

Score

10^/10

privateloader raccoon redline 27f434caa92497d1b6f4b36154ae9141 315dc1dd84dd7b872ce61c63b12c8944 4 5076357887 @tag12312341 https://t.me/insttailer nam3 discovery infostealer loader spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

315dc1dd84dd7b872ce61c63b12c8944

http://146.19.247.91/

rc4.plain

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

nam3

103.89.90.61:18728

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

https://t.me/insttailer

185.199.224.90:37143

Attributes

auth_value
1e73e022970e3ad55c62cb5010e7599b

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

5076357887

185.87.149.167:31402

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

raccoon

Botnet

27f434caa92497d1b6f4b36154ae9141

http://45.182.189.196/

rc4.plain

Extracted

Family

privateloader

http://163.123.143.4/proxies.txt

http://193.233.177.215/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2780-482-0x00000000001D0000-0x00000000001DE000-memory.dmp	family_raccoon
behavioral2/memory/2780-484-0x0000000000400000-0x0000000000454000-memory.dmp	family_raccoon
behavioral2/memory/5216-935-0x0000000002370000-0x0000000002385000-memory.dmp	family_raccoon
behavioral2/memory/5216-943-0x0000000000400000-0x0000000000522000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 16 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	family_redline
behavioral2/memory/6112-774-0x0000000000ED0000-0x0000000000F14000-memory.dmp	family_redline
behavioral2/memory/5156-780-0x00000000002C0000-0x00000000002E0000-memory.dmp	family_redline
behavioral2/memory/5268-794-0x0000000000070000-0x00000000000A0000-memory.dmp	family_redline
behavioral2/memory/5144-776-0x0000000000680000-0x00000000006C4000-memory.dmp	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
behavioral2/memory/5692-1053-0x0000000000BB0000-0x0000000000BD0000-memory.dmp	family_redline

Executes dropped EXE 12 IoCs

Processes:

real.exeF0geI.exenamdoitntn.exeromb_ro.exesafert44.exetag.exekukurzka9000.exeffnameedit.exenamdoitntn.exeg3rgg.exejshainx.exeme.exe

pid	process
1520	real.exe
2780	F0geI.exe
6112	namdoitntn.exe
6140	romb_ro.exe
5144	safert44.exe
5156	tag.exe
5216	kukurzka9000.exe
5268	ffnameedit.exe
5308	namdoitntn.exe
5956	g3rgg.exe
5692	jshainx.exe
5388	me.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\International\Geo\Nation	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 11 IoCs

Processes:

be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\g3rgg.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\romb_ro.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\me.exe	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe

Drops file in Windows directory 12 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5588 1520 WerFault.exe real.exe

pid	pid_target	process	target process
5588	1520	WerFault.exe	real.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 03bc80556daed801	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 03bc80556daed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 94e2827ce0aed801	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000004ac80ae4e4ed178a90a8be8687f30f0c2aa03bf33bf689dd19e09aef355e24f5292f73e5fbd8d7b66f88302fea752b4385b9137fe5c9d758d705c0070e0d40536dc38200d33c2b3ce5fc62aa91387302131060c738e6f5b399502018894c709720a42655d8b98b69ad255c01ffdc9b3cc6c30dc071eb5aa370e0ec4273bd4a916af203ca85efb8853424f790270204274ef4112ad979e3cb51d544ef7cfff01273cd67c8237ed7a107174cd3794850c2e5c15bf10431f09d334f8e2b87b10fcb4d55cbc278066502f31fd391114f12761f4cd95cefb18bc6e56dac635a75df1eb3aae38e7f274e144e5dd59adab778bba7b39b11119be92d9051c56413ea3d208aecd68b258191f554eff4e2b320aad51e18e5e1438d0483771ad4b0ccaf3390bc3b559d64b46787fbf62d1b8c2a1fa09b99256b9228ab5d41e84824006616f1a5b777f2c85fde199792f7c076766d661d58038b1d0d85ea9ada85ea78ae34aa8480e39d9224159f61e48f7644a25fcd6374159ed4dadd2bc21224c3c1265037d9b62700b0a2bd73170a26b41a4f80d18c0cf28e173150c40affbcc51a48c05bf11d41da9e1d	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000003c77ac3d0e29817c8e1fb85401182449c49a1d0382ce28a43bff0f561109703b84177f2b356874860e021d912fdc8f22bab3fc817d65d9681b090d62	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = df9bd97be0aed801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 487ff97ae0aed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fb059e7be0aed801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 605ceadf12afd801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

real.exe

pid process

1520 real.exe
1520 real.exe

Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	1572	MicrosoftEdge.exe
Token: SeDebugPrivilege	1572	MicrosoftEdge.exe
Token: SeDebugPrivilege	1572	MicrosoftEdge.exe
Token: SeDebugPrivilege	1572	MicrosoftEdge.exe
Token: SeDebugPrivilege	4940	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4940	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4940	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4940	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5820	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5820	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

1572 MicrosoftEdge.exe
4336 MicrosoftEdgeCP.exe
4336 MicrosoftEdgeCP.exe

pid	process
1572	MicrosoftEdge.exe
4336	MicrosoftEdgeCP.exe
4336	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 3500 wrote to memory of 1520	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	real.exe
PID 3500 wrote to memory of 1520	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	real.exe
PID 3500 wrote to memory of 1520	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	real.exe
PID 3500 wrote to memory of 2780	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	F0geI.exe
PID 3500 wrote to memory of 2780	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	F0geI.exe
PID 3500 wrote to memory of 2780	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	F0geI.exe
PID 4336 wrote to memory of 312	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 312	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 312	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 312	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4556	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 3840	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4556	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 3840	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4556	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 3840	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4556	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 3840	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4376	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4376	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4376	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4376	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4780	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4780	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4780	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 4780	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3500 wrote to memory of 6112	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	namdoitntn.exe
PID 3500 wrote to memory of 6112	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	namdoitntn.exe
PID 3500 wrote to memory of 6112	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	namdoitntn.exe
PID 3500 wrote to memory of 6140	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	romb_ro.exe
PID 3500 wrote to memory of 6140	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	romb_ro.exe
PID 3500 wrote to memory of 6140	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	romb_ro.exe
PID 3500 wrote to memory of 5144	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	safert44.exe
PID 3500 wrote to memory of 5144	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	safert44.exe
PID 3500 wrote to memory of 5144	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	safert44.exe
PID 3500 wrote to memory of 5156	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	tag.exe
PID 3500 wrote to memory of 5156	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	tag.exe
PID 3500 wrote to memory of 5156	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	tag.exe
PID 3500 wrote to memory of 5216	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	kukurzka9000.exe
PID 3500 wrote to memory of 5216	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	kukurzka9000.exe
PID 3500 wrote to memory of 5216	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	kukurzka9000.exe
PID 3500 wrote to memory of 5268	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	ffnameedit.exe
PID 3500 wrote to memory of 5268	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	ffnameedit.exe
PID 3500 wrote to memory of 5268	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	ffnameedit.exe
PID 3500 wrote to memory of 5308	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	namdoitntn.exe
PID 3500 wrote to memory of 5308	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	namdoitntn.exe
PID 3500 wrote to memory of 5308	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	namdoitntn.exe
PID 3500 wrote to memory of 5956	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	g3rgg.exe
PID 3500 wrote to memory of 5956	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	g3rgg.exe
PID 3500 wrote to memory of 5956	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	g3rgg.exe
PID 3500 wrote to memory of 5692	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	jshainx.exe
PID 3500 wrote to memory of 5692	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	jshainx.exe
PID 3500 wrote to memory of 5692	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	jshainx.exe
PID 3500 wrote to memory of 5388	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	me.exe
PID 3500 wrote to memory of 5388	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	me.exe
PID 3500 wrote to memory of 5388	3500	be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe	me.exe
PID 4336 wrote to memory of 2712	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 2712	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 2712	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4336 wrote to memory of 2712	4336	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe
"C:\Users\Admin\AppData\Local\Temp\be999ae161fe785ae48c92bb141597bef0aa748f4180b8c67134efe512454bc0.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3500

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1252
3⤵
- Program crash
PID:5588

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:2780

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
PID:6112

C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
"C:\Program Files (x86)\Company\NewProduct\romb_ro.exe"
2⤵
- Executes dropped EXE
PID:6140

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
PID:5144

C:\Program Files (x86)\Company\NewProduct\tag.exe
"C:\Program Files (x86)\Company\NewProduct\tag.exe"
2⤵
- Executes dropped EXE
PID:5156

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:5216

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
2⤵
- Executes dropped EXE
PID:5268

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
PID:5308

C:\Program Files (x86)\Company\NewProduct\g3rgg.exe
"C:\Program Files (x86)\Company\NewProduct\g3rgg.exe"
2⤵
- Executes dropped EXE
PID:5956

C:\Program Files (x86)\Company\NewProduct\jshainx.exe
"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
2⤵
- Executes dropped EXE
PID:5692

C:\Program Files (x86)\Company\NewProduct\me.exe
"C:\Program Files (x86)\Company\NewProduct\me.exe"
2⤵
- Executes dropped EXE
PID:5388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1572

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4376

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:312

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2564

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3840

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5160

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4460

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Filesize
173KB

MD5
c5acc7e661db592ec6208d6147d5b165

SHA1
642f9ab10434a77ed016921401c9361b1bb36639

SHA256
98169ab9ee35cdca15321683fe25378988a02350c9c09236d022c1202714fa4d

SHA512
92f06ee866222d47496d43ac4228e43aad2886c1a6195015d6ffa40f95fef2f803f2754e4efe620fde60808cb55a42e5c9a294098718d63f419a2e282d912161

Download Submit
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Filesize
173KB

MD5
c5acc7e661db592ec6208d6147d5b165

SHA1
642f9ab10434a77ed016921401c9361b1bb36639

SHA256
98169ab9ee35cdca15321683fe25378988a02350c9c09236d022c1202714fa4d

SHA512
92f06ee866222d47496d43ac4228e43aad2886c1a6195015d6ffa40f95fef2f803f2754e4efe620fde60808cb55a42e5c9a294098718d63f419a2e282d912161

Download Submit
C:\Program Files (x86)\Company\NewProduct\g3rgg.exe
Filesize
386KB

MD5
59be2ebcf6516dd07ee5df8eae402523

SHA1
e4e5b949a0c9721e4c89f124750d8a97e4d96c7e

SHA256
d2952be5c81f4135c0953b7b36677704f24f4d780de268ce6b67a44a6f15419a

SHA512
9148e9a303a3562f9552da8fa6cdd3c1d4034be31d20968a8dc51904c0d4cf167c0cdfa0d6ceac0ec0a24a975b8c04de9a1d4d67f0056dce810ad4e5b83215d2

Download Submit
C:\Program Files (x86)\Company\NewProduct\g3rgg.exe
Filesize
386KB

MD5
59be2ebcf6516dd07ee5df8eae402523

SHA1
e4e5b949a0c9721e4c89f124750d8a97e4d96c7e

SHA256
d2952be5c81f4135c0953b7b36677704f24f4d780de268ce6b67a44a6f15419a

SHA512
9148e9a303a3562f9552da8fa6cdd3c1d4034be31d20968a8dc51904c0d4cf167c0cdfa0d6ceac0ec0a24a975b8c04de9a1d4d67f0056dce810ad4e5b83215d2

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
b754a7159fff494383d9e7de4709aa53

SHA1
a25f172b4ed0b0a567594ad693483c821f2af14d

SHA256
4eaae9daa081304d9281c56bc508ebdb5b83f7d717784da04a08d934304f06f4

SHA512
ec244aa45a717c7374d564930a48b9b2eb151fbf2643711a9658dbb4df830d60651179a652f9281b1f56f1490e6796fb8e0ecb8fb5167fb6921f424549dddb33

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
b754a7159fff494383d9e7de4709aa53

SHA1
a25f172b4ed0b0a567594ad693483c821f2af14d

SHA256
4eaae9daa081304d9281c56bc508ebdb5b83f7d717784da04a08d934304f06f4

SHA512
ec244aa45a717c7374d564930a48b9b2eb151fbf2643711a9658dbb4df830d60651179a652f9281b1f56f1490e6796fb8e0ecb8fb5167fb6921f424549dddb33

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.1MB

MD5
b0d7a19c257498a2ddf4ff73a9b6fbcf

SHA1
07233b967c956c3cfd5498c2db6a2251769704ff

SHA256
45bb46dc46d924cba64dfb24d80656a9e11c0d83d506431c86ddc58e3487b1f3

SHA512
60ed892b712b69befb78138cc096a6cb17d367cd1a2e6ab9010d485d9e583aff226aff67cf23d04170bbbd679652ed03ec72cdd67507db8450dab3fc9ecd7147

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.1MB

MD5
b0d7a19c257498a2ddf4ff73a9b6fbcf

SHA1
07233b967c956c3cfd5498c2db6a2251769704ff

SHA256
45bb46dc46d924cba64dfb24d80656a9e11c0d83d506431c86ddc58e3487b1f3

SHA512
60ed892b712b69befb78138cc096a6cb17d367cd1a2e6ab9010d485d9e583aff226aff67cf23d04170bbbd679652ed03ec72cdd67507db8450dab3fc9ecd7147

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe
Filesize
289KB

MD5
ba9d6ca5408c517da107fd4ee6cec610

SHA1
cbf27fb8cca2aadc5378fd4f01a32178df222bfd

SHA256
b8d34c685e42f7db3219a45d06ff76fce32db0c62b7f87987a834fc79046f834

SHA512
b402eca0bf73bf3e2090042d5498aec6c1d85b5a8b712a4b01c7c6ea3ffb91b61ea0f848881704d71f3fcf3b2d7fb02485852b90cf3c5fb484921e580675ca3e

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe
Filesize
289KB

MD5
ba9d6ca5408c517da107fd4ee6cec610

SHA1
cbf27fb8cca2aadc5378fd4f01a32178df222bfd

SHA256
b8d34c685e42f7db3219a45d06ff76fce32db0c62b7f87987a834fc79046f834

SHA512
b402eca0bf73bf3e2090042d5498aec6c1d85b5a8b712a4b01c7c6ea3ffb91b61ea0f848881704d71f3fcf3b2d7fb02485852b90cf3c5fb484921e580675ca3e

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
c334f2f742fc8f7c13dfa2a01da3f46a

SHA1
d020819927da87bc5499df52e12dc5211a09ef61

SHA256
92e9d7c3e28e78b7702d1de113e7b1ffbd6fe1447159e1982e0158aafe5e75cb

SHA512
43deb443af74f5086d58d7d79af0407c2c6ef94ed338dfd2311dd595388143929a1ad8550b60d30a54e13207a3c95fa26be6fad773f191a56ca845c1055b5156

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
c334f2f742fc8f7c13dfa2a01da3f46a

SHA1
d020819927da87bc5499df52e12dc5211a09ef61

SHA256
92e9d7c3e28e78b7702d1de113e7b1ffbd6fe1447159e1982e0158aafe5e75cb

SHA512
43deb443af74f5086d58d7d79af0407c2c6ef94ed338dfd2311dd595388143929a1ad8550b60d30a54e13207a3c95fa26be6fad773f191a56ca845c1055b5156

Download Submit
C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
e699a82cef03ea485495a78f74af733d

SHA1
c5d3719a8a05f27e4f733294b8b89838f204fc64

SHA256
206104c8b944adca4068bf6d7c89fb28c68884f63d013f7dd0f67270a8220b97

SHA512
887c81ef11f4c4b5d4e135e9b6d740ce1cbfce873302c0ef80ae636492ff53a763b4ea7ad961c2bbc8b967de7a78e3ac8d3965acb679fbf69dd396466c0950a0

Download Submit
C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
e699a82cef03ea485495a78f74af733d

SHA1
c5d3719a8a05f27e4f733294b8b89838f204fc64

SHA256
206104c8b944adca4068bf6d7c89fb28c68884f63d013f7dd0f67270a8220b97

SHA512
887c81ef11f4c4b5d4e135e9b6d740ce1cbfce873302c0ef80ae636492ff53a763b4ea7ad961c2bbc8b967de7a78e3ac8d3965acb679fbf69dd396466c0950a0

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\03QQC1QW.cookie
Filesize
424B

MD5
ecfd9e293a1fc7898dbdff03c4a4588a

SHA1
f7565ce61fe868a445e66ed1ccc373f579af1a48

SHA256
7714847df207531820ea057724bb96ba0b1dc634836d64e6e7bfe60d28f471da

SHA512
b93ce7193e074782951a7a659a3622a04959d3cbf250edc452a84c80cfcbc9289b904d6ba9795cc8921bb584458f043833f2e5afff84b0e6844a13917a309404

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1FCV01M4.cookie
Filesize
676B

MD5
2e022eb0540ef0e0151acc8b11d8b903

SHA1
66e32872ff237b83b762090a30eb88aa59300f2c

SHA256
8d093384fd9ce0330c29a1519e03c54e92bc8e0505131d7606ed37004d4824dd

SHA512
40d43f6472bb282cbdd44e2a3a51906f223ad5bdd3dd2eb1eaedba912e1a1e50756e44e0c4d098913b3ac4ef13ed39027da5fa4033328d8b7e30bb41b3c2437b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\3T2PS35A.cookie
Filesize
592B

MD5
607fafe96c9d1b89a3e131748f068e55

SHA1
7d60d0a6a8687203fee06ba31491f32b328b79e8

SHA256
67de4ae6ee4584fc8f6e19183624de409503252a2dfcfb9408e34673cde676fb

SHA512
68e9720d8ab7c08ab88cfb7bb956d23271a494cad4cbe36c18fdc873cdf7bdba3c0400fa79edc6dacfeb84a105f02cd7d053832e8ac25747aa0040c5149658b4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\4H84RXWP.cookie
Filesize
172B

MD5
36a92c84612dda847c2f59a8810b2dba

SHA1
f013e92d5bfd541ee07d56ee3807ba42c9437ccc

SHA256
190313b55936f7f863d3e1a0c650f24d78f5892f4b4fabf766fdf8f60b90633c

SHA512
4a296b20b86d9517e3e5fae74857f554437bf035d1a31b4f412199ea74ac4ef7a0efab6d105bec962480b74ea2ee3153d10f505ee49564ca8e29c8ab959c1f52

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\DF0AF5VZ.cookie
Filesize
760B

MD5
45c8ebbdf19f82f84b97a91b412d8304

SHA1
4bb9a79d4dc588b5929c94c41c8ec970d07a7f19

SHA256
7ad7d3bed8b923a8ce629902e883c60b7ebde81415f936ce7fe6f11f4bd23b71

SHA512
b69b7087af058a428df06cdee48e9f39b06c566e6665c28bbb9234942243e9ec69768018934cfc22e09d98c3e383e85e38815cbd9e36727debe0202d076b9587

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\GRFRHCOJ.cookie
Filesize
844B

MD5
c5eee63dc376f65aa3608eb5d888582d

SHA1
63fcba7de2a4243b07c7c95eae4b59c1fffef415

SHA256
272515582dcb1bebff83c0cfc676aec4f30dbb02b5d308a2641651b32e637620

SHA512
3361b80a27c191e5115c4aca2020427fa8b2d9a726b2fcd41b5df8a0c4716709687f06cf47fc0cb3c9ed313fc9674b92f5453b70c6a5a367ab2262608f0c7152

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\MZKOAOLE.cookie
Filesize
256B

MD5
61f199bd4a655845a62b876a00da1b7a

SHA1
5f3fbc8281d79f042c9e7b50ebd9dd0b7050d7bc

SHA256
a73b7def756365098e1e3d47be3800a72751900cca022c6c02640d64c2f96768

SHA512
5057b6a48f22b4dd012cd50169b4fa9b98f9482984df85beb6529bed37f9672714ae4eb4f8f7e32f80876b7b486af3443b82e7829809edc4a33dc7645ebb19e8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\S9M315FC.cookie
Filesize
340B

MD5
8e2feca72f4f0ce32f703a279febd0f5

SHA1
000750e8ea5ba7f7b6d42a9e3417c4ad5b53d708

SHA256
602a3288dcac2779ba325c7c43c078ca44c9dde475b95678aaf2c53ed2ee57d0

SHA512
f3ef27683c3484120d2c1f6f9fbfd3b1abdd2337bc74c3ab0e9a7e09bad523cdfa3278d555e5082837b30b346e06985f80ae5fb26e82b85d75bcc9ed8931cd4d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\YTQTMCLV.cookie
Filesize
508B

MD5
b68c9083f19147d5abd944337911b880

SHA1
5bc28ba727095ff22c3c55290375ee062cefd3e3

SHA256
1d62c3518de4dfbb4be0ed4a02a9dc004f9f6f4e7783152b817796005c7aae3f

SHA512
53ca2333b6687d20dfbc9171b75ed9ef1ae1fb5471e1bf60e6714b7595885d7c32b3f49ba058e84fd673b8e9f506fa4f3d9c257135d3367b85f648bb196e6613

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZEERMN32.cookie
Filesize
172B

MD5
832e6caf10892cc74da28ce5f76a84a0

SHA1
b6d654cbd19b5c76f7ba34cffaa1efed881e9621

SHA256
9e4c8cd5d10e73cc15b769bee103c4c323888afaf26fc5da12426e93f769ff79

SHA512
433ebf56a17a85843aa1c78e105c7c0c0e1e967b6730ac270a9f858dbf924d5182f3f4347ac601a1f25d2e33abc6f48c88c9d45791e6a45bd600fd5872cc4e9f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ed325583eb7b4ccd2b0cefd7e1086b8f

SHA1
d5d7b7579e2ea7791f0b4aac622ef01f0a6bef42

SHA256
1ed4a94330578acf9a0836a3f995edc29d10173b56fa230a68e7457e089362c9

SHA512
f28986b313b97e92ab0432676617fbeeb918dbf13f3959448ac90c67b89a109765dff3382c82ea758feffa5d464276c060c84be482c7c52dd1b4aeeb0f1d26bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ed325583eb7b4ccd2b0cefd7e1086b8f

SHA1
d5d7b7579e2ea7791f0b4aac622ef01f0a6bef42

SHA256
1ed4a94330578acf9a0836a3f995edc29d10173b56fa230a68e7457e089362c9

SHA512
f28986b313b97e92ab0432676617fbeeb918dbf13f3959448ac90c67b89a109765dff3382c82ea758feffa5d464276c060c84be482c7c52dd1b4aeeb0f1d26bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ed325583eb7b4ccd2b0cefd7e1086b8f

SHA1
d5d7b7579e2ea7791f0b4aac622ef01f0a6bef42

SHA256
1ed4a94330578acf9a0836a3f995edc29d10173b56fa230a68e7457e089362c9

SHA512
f28986b313b97e92ab0432676617fbeeb918dbf13f3959448ac90c67b89a109765dff3382c82ea758feffa5d464276c060c84be482c7c52dd1b4aeeb0f1d26bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ed325583eb7b4ccd2b0cefd7e1086b8f

SHA1
d5d7b7579e2ea7791f0b4aac622ef01f0a6bef42

SHA256
1ed4a94330578acf9a0836a3f995edc29d10173b56fa230a68e7457e089362c9

SHA512
f28986b313b97e92ab0432676617fbeeb918dbf13f3959448ac90c67b89a109765dff3382c82ea758feffa5d464276c060c84be482c7c52dd1b4aeeb0f1d26bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ed325583eb7b4ccd2b0cefd7e1086b8f

SHA1
d5d7b7579e2ea7791f0b4aac622ef01f0a6bef42

SHA256
1ed4a94330578acf9a0836a3f995edc29d10173b56fa230a68e7457e089362c9

SHA512
f28986b313b97e92ab0432676617fbeeb918dbf13f3959448ac90c67b89a109765dff3382c82ea758feffa5d464276c060c84be482c7c52dd1b4aeeb0f1d26bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ed325583eb7b4ccd2b0cefd7e1086b8f

SHA1
d5d7b7579e2ea7791f0b4aac622ef01f0a6bef42

SHA256
1ed4a94330578acf9a0836a3f995edc29d10173b56fa230a68e7457e089362c9

SHA512
f28986b313b97e92ab0432676617fbeeb918dbf13f3959448ac90c67b89a109765dff3382c82ea758feffa5d464276c060c84be482c7c52dd1b4aeeb0f1d26bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ed325583eb7b4ccd2b0cefd7e1086b8f

SHA1
d5d7b7579e2ea7791f0b4aac622ef01f0a6bef42

SHA256
1ed4a94330578acf9a0836a3f995edc29d10173b56fa230a68e7457e089362c9

SHA512
f28986b313b97e92ab0432676617fbeeb918dbf13f3959448ac90c67b89a109765dff3382c82ea758feffa5d464276c060c84be482c7c52dd1b4aeeb0f1d26bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
b238bf22e1594b3843c696b5ab895457

SHA1
52a42c450d8fb8337c29bddc04d79229b0388a9e

SHA256
f2306c3bb10685af3e720c73b2c33ba91288428333aeab4a95724d1f1cba5f98

SHA512
0d5a0eaceb72847a1e6719b4cdfa10ca8d3f1e96f602b24dbd1c04fcd9012d37cb89d8379c01e94783aa071a2fb0a02c693c014dfcff423dc7a2f11d1253d70a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
d3ba6b5ebc67d1ce5708cf92e75befca

SHA1
ca9d4c8a0b5a850984007bc69c71a230f87e4016

SHA256
7219de9401be3ee4b2857d0fe12ce436fcf3053297b373edb6ce150ae63731f5

SHA512
62b2372dfddf8133f2e4c35668688159203199b0988e6d88d9ec793946897bdb07a33789dc14f9742740374ec1a8048fc0861b3cd9ea6430e11d00e34e5f7d20

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
memory/1520-345-0x0000000000000000-mapping.dmp

Download
memory/2780-542-0x00000000005E8000-0x00000000005F9000-memory.dmp

Filesize
68KB

Download
memory/2780-484-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2780-348-0x0000000000000000-mapping.dmp

Download
memory/2780-482-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/2780-481-0x00000000005E8000-0x00000000005F9000-memory.dmp

Filesize
68KB

Download
memory/3500-152-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-147-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-171-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-172-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-173-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-174-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-175-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-176-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-177-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-178-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-169-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-153-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-133-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-168-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-137-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-141-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-144-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-167-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-166-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-164-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-146-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-115-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-165-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-163-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-162-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-161-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-160-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-148-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-150-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-151-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-149-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-122-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-145-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-143-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-159-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-142-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-158-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-157-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-156-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-140-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-116-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-155-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-117-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-139-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-138-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-118-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-119-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-136-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-170-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-120-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-121-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-135-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-134-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-132-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-130-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-131-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-129-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-128-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-154-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-127-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-126-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-125-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-124-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-123-0x00000000776C0000-0x000000007784E000-memory.dmp

Filesize
1.6MB

Download
memory/5144-776-0x0000000000680000-0x00000000006C4000-memory.dmp

Filesize
272KB

Download
memory/5144-839-0x0000000001010000-0x0000000001016000-memory.dmp

Filesize
24KB

Download
memory/5144-493-0x0000000000000000-mapping.dmp

Download
memory/5156-983-0x0000000002730000-0x000000000277B000-memory.dmp

Filesize
300KB

Download
memory/5156-930-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5156-497-0x0000000000000000-mapping.dmp

Download
memory/5156-938-0x0000000004CE0000-0x0000000004DEA000-memory.dmp

Filesize
1.0MB

Download
memory/5156-964-0x00000000026F0000-0x000000000272E000-memory.dmp

Filesize
248KB

Download
memory/5156-780-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/5156-923-0x00000000051E0000-0x00000000057E6000-memory.dmp

Filesize
6.0MB

Download
memory/5216-502-0x0000000000000000-mapping.dmp

Download
memory/5216-935-0x0000000002370000-0x0000000002385000-memory.dmp

Filesize
84KB

Download
memory/5216-943-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/5268-794-0x0000000000070000-0x00000000000A0000-memory.dmp

Filesize
192KB

Download
memory/5268-506-0x0000000000000000-mapping.dmp

Download
memory/5308-511-0x0000000000000000-mapping.dmp

Download
memory/5388-881-0x0000000000000000-mapping.dmp

Download
memory/5692-1053-0x0000000000BB0000-0x0000000000BD0000-memory.dmp

Filesize
128KB

Download
memory/5692-874-0x0000000000000000-mapping.dmp

Download
memory/5956-1139-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5956-1112-0x0000000000470000-0x000000000051E000-memory.dmp

Filesize
696KB

Download
memory/5956-714-0x0000000000000000-mapping.dmp

Download
memory/5956-1115-0x0000000002110000-0x0000000002169000-memory.dmp

Filesize
356KB

Download
memory/5956-1118-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5956-1131-0x0000000000470000-0x000000000051E000-memory.dmp

Filesize
696KB

Download
memory/5956-1132-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/6112-488-0x0000000000000000-mapping.dmp

Download
memory/6112-774-0x0000000000ED0000-0x0000000000F14000-memory.dmp

Filesize
272KB

Download
memory/6112-836-0x00000000018F0000-0x00000000018F6000-memory.dmp

Filesize
24KB

Download
memory/6140-491-0x0000000000000000-mapping.dmp

Download