Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-08-2022 15:16
Static task
static1
Behavioral task
behavioral1
Sample
1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe
Resource
win10v2004-20220812-en
General
-
Target
1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe
-
Size
916KB
-
MD5
fb6b02d4f8e95a0fe880de0b26f8e1bf
-
SHA1
f34820a5a56bc7d21a7950b05609598a72f67b50
-
SHA256
1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af
-
SHA512
8a7fdce9129128d50e87c959b8c26e1dbfaf8b4d4cf8223dd5731100622d2721e70a6546d91b1ae3c183d9b4e933357cc7decad52740faf82af9e69aafb3a216
Malware Config
Extracted
redline
nam3
103.89.90.61:34589
-
auth_value
64b900120bbceaa6a9c60e9079492895
Extracted
redline
5
176.113.115.146:9582
-
auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f
Extracted
redline
5076357887
195.54.170.157:16525
-
auth_value
0dfaff60271d374d0c206d19883e06f3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 9 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline behavioral1/memory/1980-167-0x0000000000F00000-0x0000000000F20000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\safert44.exe family_redline behavioral1/memory/1860-172-0x00000000002D0000-0x0000000000314000-memory.dmp family_redline behavioral1/memory/4272-171-0x0000000000620000-0x0000000000640000-memory.dmp family_redline C:\Program Files (x86)\Company\NewProduct\jshainx.exe family_redline C:\Program Files (x86)\Company\NewProduct\jshainx.exe family_redline -
Executes dropped EXE 7 IoCs
Processes:
F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.exejshainx.exeme.exepid process 3596 F0geI.exe 3664 kukurzka9000.exe 1980 namdoitntn.exe 3724 real.exe 1860 safert44.exe 4272 jshainx.exe 8 me.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 9 IoCs
Processes:
1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exesetup.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jshainx.exe 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b54c577e-7ac6-4e49-adfc-94052cefd7e0.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220815171635.pma setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\me.exe 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4808 3596 WerFault.exe F0geI.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
real.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 real.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString real.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exereal.exejshainx.exeidentity_helper.exenamdoitntn.exesafert44.exemsedge.exepid process 820 msedge.exe 820 msedge.exe 2820 msedge.exe 2820 msedge.exe 3776 msedge.exe 4124 msedge.exe 4124 msedge.exe 3776 msedge.exe 2180 msedge.exe 2180 msedge.exe 380 msedge.exe 380 msedge.exe 3724 real.exe 3724 real.exe 4272 jshainx.exe 4272 jshainx.exe 3660 identity_helper.exe 3660 identity_helper.exe 1980 namdoitntn.exe 1980 namdoitntn.exe 1860 safert44.exe 1860 safert44.exe 1284 msedge.exe 1284 msedge.exe 1284 msedge.exe 1284 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 380 msedge.exe 380 msedge.exe 380 msedge.exe 380 msedge.exe 380 msedge.exe 380 msedge.exe 380 msedge.exe 380 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jshainx.exenamdoitntn.exesafert44.exedescription pid process Token: SeDebugPrivilege 4272 jshainx.exe Token: SeDebugPrivilege 1980 namdoitntn.exe Token: SeDebugPrivilege 1860 safert44.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 380 msedge.exe 380 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription pid process target process PID 1084 wrote to memory of 380 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1084 wrote to memory of 380 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1084 wrote to memory of 2188 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1084 wrote to memory of 2188 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 380 wrote to memory of 4688 380 msedge.exe msedge.exe PID 380 wrote to memory of 4688 380 msedge.exe msedge.exe PID 2188 wrote to memory of 1488 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1488 2188 msedge.exe msedge.exe PID 1084 wrote to memory of 1548 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1084 wrote to memory of 1548 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1084 wrote to memory of 4944 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1084 wrote to memory of 4944 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1548 wrote to memory of 2448 1548 msedge.exe msedge.exe PID 1548 wrote to memory of 2448 1548 msedge.exe msedge.exe PID 4944 wrote to memory of 220 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 220 4944 msedge.exe msedge.exe PID 1084 wrote to memory of 2224 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 1084 wrote to memory of 2224 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe msedge.exe PID 2224 wrote to memory of 2828 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2828 2224 msedge.exe msedge.exe PID 1084 wrote to memory of 3596 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe F0geI.exe PID 1084 wrote to memory of 3596 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe F0geI.exe PID 1084 wrote to memory of 3596 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe F0geI.exe PID 1084 wrote to memory of 3664 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe kukurzka9000.exe PID 1084 wrote to memory of 3664 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe kukurzka9000.exe PID 1084 wrote to memory of 3664 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe kukurzka9000.exe PID 1084 wrote to memory of 1980 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe namdoitntn.exe PID 1084 wrote to memory of 1980 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe namdoitntn.exe PID 1084 wrote to memory of 1980 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe namdoitntn.exe PID 1084 wrote to memory of 3724 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe real.exe PID 1084 wrote to memory of 3724 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe real.exe PID 1084 wrote to memory of 3724 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe real.exe PID 1084 wrote to memory of 1860 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe safert44.exe PID 1084 wrote to memory of 1860 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe safert44.exe PID 1084 wrote to memory of 1860 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe safert44.exe PID 1084 wrote to memory of 4272 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe jshainx.exe PID 1084 wrote to memory of 4272 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe jshainx.exe PID 1084 wrote to memory of 4272 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe jshainx.exe PID 1084 wrote to memory of 8 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe me.exe PID 1084 wrote to memory of 8 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe me.exe PID 1084 wrote to memory of 8 1084 1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe me.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4948 2188 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe"C:\Users\Admin\AppData\Local\Temp\1dd402d450c484140663b57c516ca68b10f31976f324f268ac6e564c6ca177af.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC42⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe36c246f8,0x7ffe36c24708,0x7ffe36c247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6276 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5748 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff7195d5460,0x7ff7195d5470,0x7ff7195d54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1676 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3056 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,5388699035977405259,12686178943790817227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1780 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe36c246f8,0x7ffe36c24708,0x7ffe36c247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18014474147247941417,15252045188593479463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18014474147247941417,15252045188593479463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe36c246f8,0x7ffe36c24708,0x7ffe36c247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4585369562042299332,16027373979534534688,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4585369562042299332,16027373979534534688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe36c246f8,0x7ffe36c24708,0x7ffe36c247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8318062371239680629,2794544761834058103,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,8318062371239680629,2794544761834058103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nN6Z42⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe36c246f8,0x7ffe36c24708,0x7ffe36c247183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15147748639857551485,1521706236854423979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15147748639857551485,1521706236854423979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exe"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 7683⤵
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\real.exe"C:\Program Files (x86)\Company\NewProduct\real.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\safert44.exe"C:\Program Files (x86)\Company\NewProduct\safert44.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\me.exe"C:\Program Files (x86)\Company\NewProduct\me.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exe"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3596 -ip 35961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
339KB
MD5501e0f6fa90340e3d7ff26f276cd582e
SHA11bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exeFilesize
339KB
MD5501e0f6fa90340e3d7ff26f276cd582e
SHA11bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exeFilesize
107KB
MD52647a5be31a41a39bf2497125018dbce
SHA1a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA25684c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
SHA51268f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exeFilesize
107KB
MD52647a5be31a41a39bf2497125018dbce
SHA1a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA25684c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
SHA51268f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
669KB
MD5b5942a0be0b72e121dadb762044f38cc
SHA1885909607a9747c11eac6cc47b775ad947980c5e
SHA256c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1
SHA512d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exeFilesize
669KB
MD5b5942a0be0b72e121dadb762044f38cc
SHA1885909607a9747c11eac6cc47b775ad947980c5e
SHA256c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1
SHA512d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7
-
C:\Program Files (x86)\Company\NewProduct\me.exeFilesize
274KB
MD52eee4c301ce357df8f235957fcb774b3
SHA1f9fd1eac58b5f40475269a1e8eb1675227e2389c
SHA25666cc79df9054fda09648b64a230427d4a574f8349de871e922fbd20432b431f1
SHA512590589c3f8ee16f12539b943ba04402771372fe7748fb689c03b5681466ec8d3f3778007224e0a7fac1413f188aaee59a754cad2d0194af1130a8ad3191466fc
-
C:\Program Files (x86)\Company\NewProduct\me.exeFilesize
274KB
MD52eee4c301ce357df8f235957fcb774b3
SHA1f9fd1eac58b5f40475269a1e8eb1675227e2389c
SHA25666cc79df9054fda09648b64a230427d4a574f8349de871e922fbd20432b431f1
SHA512590589c3f8ee16f12539b943ba04402771372fe7748fb689c03b5681466ec8d3f3778007224e0a7fac1413f188aaee59a754cad2d0194af1130a8ad3191466fc
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
107KB
MD5bbd8ea73b7626e0ca5b91d355df39b7f
SHA166e298653beb7f652eb44922010910ced6242879
SHA2561aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exeFilesize
107KB
MD5bbd8ea73b7626e0ca5b91d355df39b7f
SHA166e298653beb7f652eb44922010910ced6242879
SHA2561aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
274KB
MD56f6b64ee71021439e50f32cfea2c19a9
SHA1a7d0b57904e9572ff9994f656c50daf55068cd75
SHA2563bd07a00c9e492bdd65b36dbe6fd91c30bfa2c8ced7e627f35011e5356c7e1d2
SHA5120ab19e6bcedd6eef3347133208fcb275ffbf534176fe09f6c5d9e715ef3db4704abb0491d974be8858eda129e3706982999626a649780666a1a24972c6084ae0
-
C:\Program Files (x86)\Company\NewProduct\real.exeFilesize
274KB
MD56f6b64ee71021439e50f32cfea2c19a9
SHA1a7d0b57904e9572ff9994f656c50daf55068cd75
SHA2563bd07a00c9e492bdd65b36dbe6fd91c30bfa2c8ced7e627f35011e5356c7e1d2
SHA5120ab19e6bcedd6eef3347133208fcb275ffbf534176fe09f6c5d9e715ef3db4704abb0491d974be8858eda129e3706982999626a649780666a1a24972c6084ae0
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
246KB
MD5414ffd7094c0f50662ffa508ca43b7d0
SHA16ec67bd53da2ff3d5538a3afcc6797af1e5a53fb
SHA256d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee
SHA512c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399
-
C:\Program Files (x86)\Company\NewProduct\safert44.exeFilesize
246KB
MD5414ffd7094c0f50662ffa508ca43b7d0
SHA16ec67bd53da2ff3d5538a3afcc6797af1e5a53fb
SHA256d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee
SHA512c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
112KB
MD530e375798049100677ea16b7c578a4ee
SHA1bcab7401a5f34ac0e6f795ece8d3ed12944ae99f
SHA256ea5c90cfc97f429a2f9e0b1e9b16778b5b19bd8e83a896a30002de70af84e1ce
SHA512f8ae930e26ecfe06dc30d4f39858b0eec6b4a81a8139883712505b5c6b58504d463d986ef58c7151a247fe157c6013b570b9d39e1d4a860061e37e0419900582
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5379cd706dcc90548d0d341f8070a9734
SHA11122310617665f42c133a0fb43aa2af5aba46a85
SHA2561d8e075d1154091cc4ec3e12a23a2a81d184f86552e85de3768d31c0fe82f628
SHA512340a4adf2e15d9b9dacb0f984aa80ab4fc2282483af62ed19eb8bf0fec0daba28c2b00093128bc1643f1a224ded1d6f3a7b969061fef4f1e8e3598040c2b407a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5bbbd0f8b72f94713089c5393c44f66f6
SHA1ce3c73a65dca765bf4e7928b98eb95ffe9a17a87
SHA256663fc1aafe1ce45efa189c7d78358b67fe1d77fa76f81230a831bc5449ea007e
SHA51248389c104f39247a25e58ac50be5a0aa146b75d31c465e452841154176c5468a3643756918650f80cae29465824ec466229af065beec46b5f76d5aa07fa073d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5c1b845a08f379f413f2c1cce6d485824
SHA1bd0cefbc1839b9802ba96e79cf5ffd8dfccf3595
SHA25622a5380134cf903312a9e41a5bbf1e7a4065bc1a80ba151deada93e5337d7f7c
SHA512247a8f267078ac2ef3c5c399663ab1c3eaca2f2a48510ae2acc7becfffcb1d1054e322caec142b121c042204e9005a7f4d8e4ee0b10e72dc0189e28cafb4eb48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5b6c92df02c14fc3e7f3777f649ba0dfa
SHA1c9fff80686a4aee19e2d492876a3191f5a8fdae1
SHA256c42001f62d78e2e2f7e04b66cedee2c2e1200a0e4f50991d1a341b47ff332e12
SHA51226a814bb6fb6bdb626b9d8d62ff19b2967e4b59458df902cd5be98e1a34d1ab5c996ce35b014a85dfb251d6d7673e899e516be24feefe05d73fe5dbb19b5b356
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5bbbd0f8b72f94713089c5393c44f66f6
SHA1ce3c73a65dca765bf4e7928b98eb95ffe9a17a87
SHA256663fc1aafe1ce45efa189c7d78358b67fe1d77fa76f81230a831bc5449ea007e
SHA51248389c104f39247a25e58ac50be5a0aa146b75d31c465e452841154176c5468a3643756918650f80cae29465824ec466229af065beec46b5f76d5aa07fa073d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5c1b845a08f379f413f2c1cce6d485824
SHA1bd0cefbc1839b9802ba96e79cf5ffd8dfccf3595
SHA25622a5380134cf903312a9e41a5bbf1e7a4065bc1a80ba151deada93e5337d7f7c
SHA512247a8f267078ac2ef3c5c399663ab1c3eaca2f2a48510ae2acc7becfffcb1d1054e322caec142b121c042204e9005a7f4d8e4ee0b10e72dc0189e28cafb4eb48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5b6c92df02c14fc3e7f3777f649ba0dfa
SHA1c9fff80686a4aee19e2d492876a3191f5a8fdae1
SHA256c42001f62d78e2e2f7e04b66cedee2c2e1200a0e4f50991d1a341b47ff332e12
SHA51226a814bb6fb6bdb626b9d8d62ff19b2967e4b59458df902cd5be98e1a34d1ab5c996ce35b014a85dfb251d6d7673e899e516be24feefe05d73fe5dbb19b5b356
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD521d5f8e6e8445b1be140466babf7d248
SHA1bf982960cad1bbc95d9190eb1ae8118912e29dcf
SHA2560f696d8767de599a1e98f15ac54835a5016f99d24b8d44e4b5e9d2e579ac715b
SHA5127eb3e3e42415a5718cdcc94363c2e24b3cb23ee547f09ad31a17f4693ac96824d9afdc6378f27f0de15366d3c8ef93be4588fc6d95807d964dd91dc29ff9cf29
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5379cd706dcc90548d0d341f8070a9734
SHA11122310617665f42c133a0fb43aa2af5aba46a85
SHA2561d8e075d1154091cc4ec3e12a23a2a81d184f86552e85de3768d31c0fe82f628
SHA512340a4adf2e15d9b9dacb0f984aa80ab4fc2282483af62ed19eb8bf0fec0daba28c2b00093128bc1643f1a224ded1d6f3a7b969061fef4f1e8e3598040c2b407a
-
\??\pipe\LOCAL\crashpad_1548_EVOXMDHQZZTCPXTTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_2188_EAUALZRXDYMKBXNRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_2224_AZQNXDRYEQOGEUJIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_380_ZCRLJSYGIAKFEPMLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4944_VDEDEXPXDMPTBHMHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/8-168-0x0000000000000000-mapping.dmp
-
memory/220-139-0x0000000000000000-mapping.dmp
-
memory/380-132-0x0000000000000000-mapping.dmp
-
memory/392-186-0x0000000000000000-mapping.dmp
-
memory/708-258-0x0000000000000000-mapping.dmp
-
memory/820-196-0x0000000000000000-mapping.dmp
-
memory/1284-187-0x0000000000000000-mapping.dmp
-
memory/1284-280-0x0000000000000000-mapping.dmp
-
memory/1316-206-0x0000000000000000-mapping.dmp
-
memory/1488-135-0x0000000000000000-mapping.dmp
-
memory/1548-136-0x0000000000000000-mapping.dmp
-
memory/1860-207-0x00000000053B0000-0x00000000059C8000-memory.dmpFilesize
6.1MB
-
memory/1860-267-0x0000000005380000-0x000000000539E000-memory.dmpFilesize
120KB
-
memory/1860-156-0x0000000000000000-mapping.dmp
-
memory/1860-268-0x0000000006AF0000-0x0000000006CB2000-memory.dmpFilesize
1.8MB
-
memory/1860-273-0x00000000069F0000-0x0000000006A40000-memory.dmpFilesize
320KB
-
memory/1860-172-0x00000000002D0000-0x0000000000314000-memory.dmpFilesize
272KB
-
memory/1860-269-0x0000000008540000-0x0000000008A6C000-memory.dmpFilesize
5.2MB
-
memory/1860-215-0x0000000004DF0000-0x0000000004E2C000-memory.dmpFilesize
240KB
-
memory/1860-263-0x0000000005130000-0x00000000051A6000-memory.dmpFilesize
472KB
-
memory/1860-211-0x0000000004EC0000-0x0000000004FCA000-memory.dmpFilesize
1.0MB
-
memory/1860-265-0x00000000059D0000-0x0000000005A62000-memory.dmpFilesize
584KB
-
memory/1980-167-0x0000000000F00000-0x0000000000F20000-memory.dmpFilesize
128KB
-
memory/1980-150-0x0000000000000000-mapping.dmp
-
memory/2180-191-0x0000000000000000-mapping.dmp
-
memory/2188-133-0x0000000000000000-mapping.dmp
-
memory/2224-143-0x0000000000000000-mapping.dmp
-
memory/2448-138-0x0000000000000000-mapping.dmp
-
memory/2744-245-0x0000000000000000-mapping.dmp
-
memory/2820-195-0x0000000000000000-mapping.dmp
-
memory/2828-144-0x0000000000000000-mapping.dmp
-
memory/3224-256-0x0000000000000000-mapping.dmp
-
memory/3536-189-0x0000000000000000-mapping.dmp
-
memory/3596-146-0x0000000000000000-mapping.dmp
-
memory/3596-261-0x00000000007AD000-0x00000000007BD000-memory.dmpFilesize
64KB
-
memory/3596-190-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/3596-175-0x00000000007AD000-0x00000000007BD000-memory.dmpFilesize
64KB
-
memory/3596-262-0x00000000005B0000-0x00000000005C0000-memory.dmpFilesize
64KB
-
memory/3596-176-0x00000000005B0000-0x00000000005C0000-memory.dmpFilesize
64KB
-
memory/3660-270-0x0000000000000000-mapping.dmp
-
memory/3664-224-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/3664-221-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/3664-149-0x0000000000000000-mapping.dmp
-
memory/3724-220-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/3724-155-0x0000000000000000-mapping.dmp
-
memory/3776-192-0x0000000000000000-mapping.dmp
-
memory/4124-197-0x0000000000000000-mapping.dmp
-
memory/4220-275-0x0000000000000000-mapping.dmp
-
memory/4272-161-0x0000000000000000-mapping.dmp
-
memory/4272-264-0x0000000005FA0000-0x0000000006544000-memory.dmpFilesize
5.6MB
-
memory/4272-171-0x0000000000620000-0x0000000000640000-memory.dmpFilesize
128KB
-
memory/4272-266-0x0000000005350000-0x00000000053B6000-memory.dmpFilesize
408KB
-
memory/4272-210-0x0000000004E70000-0x0000000004E82000-memory.dmpFilesize
72KB
-
memory/4676-274-0x0000000000000000-mapping.dmp
-
memory/4688-134-0x0000000000000000-mapping.dmp
-
memory/4704-194-0x0000000000000000-mapping.dmp
-
memory/4896-260-0x0000000000000000-mapping.dmp
-
memory/4944-137-0x0000000000000000-mapping.dmp
-
memory/4948-185-0x0000000000000000-mapping.dmp
-
memory/4964-279-0x0000000000000000-mapping.dmp
-
memory/5220-212-0x0000000000000000-mapping.dmp
-
memory/5348-214-0x0000000000000000-mapping.dmp
-
memory/5720-217-0x0000000000000000-mapping.dmp
-
memory/5912-231-0x0000000000000000-mapping.dmp
-
memory/5996-235-0x0000000000000000-mapping.dmp
-
memory/6032-239-0x0000000000000000-mapping.dmp
-
memory/6032-282-0x0000000000000000-mapping.dmp
-
memory/6036-277-0x0000000000000000-mapping.dmp