fabookie | 5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe

Analysis

max time kernel
85s
max time network
152s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
18/09/2023, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe
Size

261KB
MD5

7d7d1dcd68f5076ecbb2ab3feb870a4c
SHA1

a363963eb016a563f9ee6fec5e410f240513a36c
SHA256

5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe
SHA512

24682d2c14e5036e53d4e934a4b4585e8a983bf0953bfa4bba0499b28cc3fb2f4a02d268e57da14dfedb1c666476279b86ce3d7369e7c25af79fab001ba372fa
SSDEEP

6144:ZEvJm09zORs+z/TMify9DAO4qQe1zVTv8/:ZMw09CK5NtF1zVD8/

Score

10^/10

fabookie glupteba redline smokeloader 0305 up3 backdoor discovery dropper infostealer loader spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

0305

185.215.113.25:10195

Attributes

auth_value
c86205ff1cc37b2da12f0190adfda52c

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral1/memory/1480-208-0x0000000002E60000-0x0000000002F91000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 4 IoCs

resource	yara_rule
behavioral1/memory/2460-148-0x0000000002DF0000-0x00000000036DB000-memory.dmp	family_glupteba
behavioral1/memory/2460-149-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2460-212-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2460-226-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
1324	8410.exe
4404	8588.exe
4604	8B07.exe
4492	9087.exe
4628	9B65.exe
1480	ss41.exe
192	toolspub2.exe
1568	toolspub2.exe
2460	31839b57a4f11171d6abc8bbc4451ee4.exe

Loads dropped DLL 2 IoCs

pid	Process
3396	rundll32.exe
3024	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 832 set thread context of 960	832	5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe	71
PID 4492 set thread context of 3404	4492	9087.exe	88
PID 192 set thread context of 1568	192	toolspub2.exe	89

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cf084c3fdde9d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e810893edde9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings	8B07.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ef51263edde9d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 148b6f3ddde9d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8ab6bf3cdde9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
960	AppLaunch.exe
960	AppLaunch.exe
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3216	Process not Found

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
960	AppLaunch.exe
1568	toolspub2.exe
4528	MicrosoftEdgeCP.exe
4528	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	4492	9087.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	1324	8410.exe
Token: SeDebugPrivilege	3404	aspnet_compiler.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	4404	8588.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	2292	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2292	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2292	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2292	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4856	MicrosoftEdge.exe
4528	MicrosoftEdgeCP.exe
2292	MicrosoftEdgeCP.exe
4528	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 960	832	5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe	71
PID 832 wrote to memory of 960	832	5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe	71
PID 832 wrote to memory of 960	832	5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe	71
PID 832 wrote to memory of 960	832	5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe	71
PID 832 wrote to memory of 960	832	5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe	71
PID 832 wrote to memory of 960	832	5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe	71
PID 3216 wrote to memory of 1324	3216	Process not Found	72
PID 3216 wrote to memory of 1324	3216	Process not Found	72
PID 3216 wrote to memory of 1324	3216	Process not Found	72
PID 3216 wrote to memory of 4404	3216	Process not Found	73
PID 3216 wrote to memory of 4404	3216	Process not Found	73
PID 3216 wrote to memory of 4404	3216	Process not Found	73
PID 3216 wrote to memory of 4604	3216	Process not Found	75
PID 3216 wrote to memory of 4604	3216	Process not Found	75
PID 3216 wrote to memory of 4604	3216	Process not Found	75
PID 3216 wrote to memory of 1888	3216	Process not Found	97
PID 3216 wrote to memory of 1888	3216	Process not Found	97
PID 4604 wrote to memory of 1892	4604	8B07.exe	78
PID 4604 wrote to memory of 1892	4604	8B07.exe	78
PID 4604 wrote to memory of 1892	4604	8B07.exe	78
PID 3216 wrote to memory of 4492	3216	Process not Found	80
PID 3216 wrote to memory of 4492	3216	Process not Found	80
PID 1892 wrote to memory of 3396	1892	control.exe	81
PID 1892 wrote to memory of 3396	1892	control.exe	81
PID 1892 wrote to memory of 3396	1892	control.exe	81
PID 3216 wrote to memory of 4628	3216	Process not Found	85
PID 3216 wrote to memory of 4628	3216	Process not Found	85
PID 3216 wrote to memory of 4628	3216	Process not Found	85
PID 4628 wrote to memory of 1480	4628	9B65.exe	86
PID 4628 wrote to memory of 1480	4628	9B65.exe	86
PID 4492 wrote to memory of 3404	4492	9087.exe	88
PID 4492 wrote to memory of 3404	4492	9087.exe	88
PID 4492 wrote to memory of 3404	4492	9087.exe	88
PID 4628 wrote to memory of 192	4628	9B65.exe	87
PID 4628 wrote to memory of 192	4628	9B65.exe	87
PID 4628 wrote to memory of 192	4628	9B65.exe	87
PID 4492 wrote to memory of 3404	4492	9087.exe	88
PID 4492 wrote to memory of 3404	4492	9087.exe	88
PID 4492 wrote to memory of 3404	4492	9087.exe	88
PID 192 wrote to memory of 1568	192	toolspub2.exe	89
PID 192 wrote to memory of 1568	192	toolspub2.exe	89
PID 192 wrote to memory of 1568	192	toolspub2.exe	89
PID 192 wrote to memory of 1568	192	toolspub2.exe	89
PID 192 wrote to memory of 1568	192	toolspub2.exe	89
PID 192 wrote to memory of 1568	192	toolspub2.exe	89
PID 4628 wrote to memory of 2460	4628	9B65.exe	90
PID 4628 wrote to memory of 2460	4628	9B65.exe	90
PID 4628 wrote to memory of 2460	4628	9B65.exe	90
PID 3396 wrote to memory of 2320	3396	rundll32.exe	94
PID 3396 wrote to memory of 2320	3396	rundll32.exe	94
PID 2320 wrote to memory of 3024	2320	RunDll32.exe	95
PID 2320 wrote to memory of 3024	2320	RunDll32.exe	95
PID 2320 wrote to memory of 3024	2320	RunDll32.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe
"C:\Users\Admin\AppData\Local\Temp\5155de2312b9523c8f56a6c913b64d3e916323d68030c715e4371909a1b4e2fe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:960

C:\Users\Admin\AppData\Local\Temp\8410.exe
C:\Users\Admin\AppData\Local\Temp\8410.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Users\Admin\AppData\Local\Temp\8588.exe
C:\Users\Admin\AppData\Local\Temp\8588.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Users\Admin\AppData\Local\Temp\8B07.exe
C:\Users\Admin\AppData\Local\Temp\8B07.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\~Y86D4.cPl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\~Y86D4.cPl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\~Y86D4.cPl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\~Y86D4.cPl",
        5⤵
        Loads dropped DLL
        
        PID:3024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8CBD.bat" "
1⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\9087.exe
C:\Users\Admin\AppData\Local\Temp\9087.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1520

C:\Users\Admin\AppData\Local\Temp\9B65.exe
C:\Users\Admin\AppData\Local\Temp\9B65.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Local\Temp\ss41.exe
  "C:\Users\Admin\AppData\Local\Temp\ss41.exe"
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:192
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:1568
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:3552
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3748

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0G1F2NWK\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JDO7V4E0\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5d13c93c1ffbc325327f9848b8346003

SHA1
0a2678ebe23dfeea13cb8f529f55ac0cac436054

SHA256
54836d31af906348184544664235fc815918029551f45ac159369ebc3aa570c4

SHA512
7688770276507d81af8b683753af694ece3eca88285022d544da6c1647d11ba69f6f3312f42f05115ac2b7bd40b5c6c14093e99fa31db60a7d864a6c1c1130ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724

Filesize
472B

MD5
149a7377ce505162af15127c384d5e3b

SHA1
f4bf765455a03741b3c401204af7aadc8356e4a4

SHA256
f6731d465327021f3b3ced0bb1087faf90bf1d7b7619edb8b94dbf3f80fd3f43

SHA512
06ea8e0a9348ff73c0ca08ffde9ca5747697f80b61ae5f83e28c8ad54320398b9e9bc3a3d892921c9beb6ce55ebf7c910dbcd99bfec178b710f5e6a55fca522d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
aa62f8ce77e072c8160c71b5df3099b0

SHA1
06b8c07db93694a3fe73a4276283fabb0e20ac38

SHA256
3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

SHA512
71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a3cde09803e2acef3a1bdc6978f5110f

SHA1
cd07a0242619f498c4ced9dd439630fe2df6d3dc

SHA256
435ed46019bc10423441cea3543d9cdc4ec976326f305fed17e19f13d1ebb630

SHA512
c6cf315d91dccbd1b0abb1f3a99090b773485444bda17e4040cc34176d38d024f74243c94fee91c826b5ff9de2106d44ddec52ea0d515e7ac2a26dcc8540dc07

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724

Filesize
410B

MD5
5bc716310680264abf62f9f8b515999e

SHA1
0e0c4d0b459d4e00090c4d5b38028db0d4426657

SHA256
26334185a94db2e2efe4becd00e4fb159d2844789599b2f7e3dfbecb88e2b8ad

SHA512
53d24e241edbb2e89fc90000d25275c8c77d8865a5a0dbae84ffab23b8ed7a5a1004eb37295460ffda578e38c7d681f5685199ac7f2c571523bc77eca1f985b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
ceaa1c308a6ee2be4795cc41e36c898b

SHA1
b7102d780ee261f8881174cab3ec1e94d587a49f

SHA256
f049513faede1637d16824c231e76c1ee594a8606d1e087f9ad0edd8f13a650e

SHA512
f8732af2b508ef9595e1ce63895cef7728aded3c6789ca1f345a91166706f3bdf16700cdd4686d4c0e16e20fb97e05a75c9a7718c9fdffa12f8eb84ede592a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
637f73095de9f62dc6fcfbe9b3f6d3d6

SHA1
708771d9413e7df69189d2a0c283ec72bd63d99e

SHA256
6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

SHA512
00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
637f73095de9f62dc6fcfbe9b3f6d3d6

SHA1
708771d9413e7df69189d2a0c283ec72bd63d99e

SHA256
6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

SHA512
00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
637f73095de9f62dc6fcfbe9b3f6d3d6

SHA1
708771d9413e7df69189d2a0c283ec72bd63d99e

SHA256
6a678e471f24d7560be7cda7a49a34b4f0c2cb279b779984e5f002be3dfacf1d

SHA512
00d4d05c7b894d4c52dcbc75d555c76f966defed1934747ffe4a29d8dc1b426fad021a02a5e221dd583ac86d67661a6b9cddde13ad1465546439f52ed567aeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8410.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\8410.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\8588.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\8588.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B07.exe

Filesize
1.7MB

MD5
6f976ced94fd2d7c7710d769518717b2

SHA1
7f83660011c28c001dbace656df28c5f6190cdca

SHA256
ec3ef6a1748199c67b7e0a454305fa8566a42c1cb2717d1a24033f725ca08d8e

SHA512
ba7749269a22ff979ee13181f4df1cc7e132f1c49e23b622c70d1868eec6cc8224171899395fd2728494df9a59404a1f9903a7d263121da386253d569449cef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\8B07.exe

Filesize
1.7MB

MD5
6f976ced94fd2d7c7710d769518717b2

SHA1
7f83660011c28c001dbace656df28c5f6190cdca

SHA256
ec3ef6a1748199c67b7e0a454305fa8566a42c1cb2717d1a24033f725ca08d8e

SHA512
ba7749269a22ff979ee13181f4df1cc7e132f1c49e23b622c70d1868eec6cc8224171899395fd2728494df9a59404a1f9903a7d263121da386253d569449cef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\8CBD.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\9087.exe

Filesize
896KB

MD5
7b4f90ff07d0fa2e763fd680b1e963c9

SHA1
47f1d9453dd31b2467f3f11580fba975ed69246d

SHA256
5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0

SHA512
5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9087.exe

Filesize
896KB

MD5
7b4f90ff07d0fa2e763fd680b1e963c9

SHA1
47f1d9453dd31b2467f3f11580fba975ed69246d

SHA256
5228ff83506f82456b550462d53e68f7bc82b793d99c167b6674d853aa6b68b0

SHA512
5385fb7df409be3214a1de1b565694ed6e3491ff0f066709084673cc2975560895ab473dfc8a35ec25be999ea32abbc21c7732b99fa51792103f1e05f1e1ea9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B65.exe

Filesize
4.6MB

MD5
b32d5a382373d7df0c1fec9f15f0724a

SHA1
472fc4c27859f39e8b9a0bf784949f72944dc52b

SHA256
010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

SHA512
1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B65.exe

Filesize
4.6MB

MD5
b32d5a382373d7df0c1fec9f15f0724a

SHA1
472fc4c27859f39e8b9a0bf784949f72944dc52b

SHA256
010fe481ba6275ebbf71e102e66d73f5d819252f2b4b1893d2acf53c04f4200f

SHA512
1320be23719f86e043beaeea8affa9ab125a68a1210f596c4424d4a5a2a9ef72eb572578897722842ad0586afe1d669ff816648ea3eeb3aa0b8379c9066da3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vko1tkil.vpx.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
227KB

MD5
fccd5785d54697b968ebe3c55641c4b3

SHA1
f3353f2cfb27100ea14ae6ad02a72f834694fbf3

SHA256
757568f5af7731014baf25b6941c179d14b2041d2aa8a43e482a942e99d86f82

SHA512
0360e3c3469219f6c13ab3bd0c47304c6bb1319463c4102433156400ebfbf468b88f9b469eeb01e78ed32021adb93d52e9dd410dcc9d44e5dbee67f9a51aed6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~Y86D4.cPl

Filesize
1.4MB

MD5
574092afef8e5b9898ea75a03b27deb7

SHA1
ae0d385c82de5cb9919da894ab0594fd850fb246

SHA256
56e9641babe131424cfbfe7df4696b0526f2dd0d8c6b5161008c870dbb405c18

SHA512
dd380eae94f39b3bdc3f7eb286ade4cd32bd533a2180bc8a10199e9b2a00880aa291aa9e96358c6d5fb52e62ec979697b063e1c9324d29ce562015e6c752c66b

Download Submit
\Users\Admin\AppData\Local\Temp\~y86D4.cpl

Filesize
1.4MB

MD5
574092afef8e5b9898ea75a03b27deb7

SHA1
ae0d385c82de5cb9919da894ab0594fd850fb246

SHA256
56e9641babe131424cfbfe7df4696b0526f2dd0d8c6b5161008c870dbb405c18

SHA512
dd380eae94f39b3bdc3f7eb286ade4cd32bd533a2180bc8a10199e9b2a00880aa291aa9e96358c6d5fb52e62ec979697b063e1c9324d29ce562015e6c752c66b

Download Submit
\Users\Admin\AppData\Local\Temp\~y86D4.cpl

Filesize
1.4MB

MD5
574092afef8e5b9898ea75a03b27deb7

SHA1
ae0d385c82de5cb9919da894ab0594fd850fb246

SHA256
56e9641babe131424cfbfe7df4696b0526f2dd0d8c6b5161008c870dbb405c18

SHA512
dd380eae94f39b3bdc3f7eb286ade4cd32bd533a2180bc8a10199e9b2a00880aa291aa9e96358c6d5fb52e62ec979697b063e1c9324d29ce562015e6c752c66b

Download Submit
memory/192-129-0x0000000000780000-0x0000000000789000-memory.dmp

Filesize
36KB

Download
memory/192-134-0x00000000007A0000-0x00000000008A0000-memory.dmp

Filesize
1024KB

Download
memory/960-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1324-36-0x0000000007AB0000-0x0000000007AEE000-memory.dmp

Filesize
248KB

Download
memory/1324-27-0x0000000007990000-0x000000000799A000-memory.dmp

Filesize
40KB

Download
memory/1324-161-0x000000000A2C0000-0x000000000A7EC000-memory.dmp

Filesize
5.2MB

Download
memory/1324-162-0x0000000009AC0000-0x0000000009ADE000-memory.dmp

Filesize
120KB

Download
memory/1324-278-0x0000000073A10000-0x00000000740FE000-memory.dmp

Filesize
6.9MB

Download
memory/1324-51-0x00000000082E0000-0x0000000008346000-memory.dmp

Filesize
408KB

Download
memory/1324-37-0x0000000007B10000-0x0000000007B5B000-memory.dmp

Filesize
300KB

Download
memory/1324-96-0x0000000073A10000-0x00000000740FE000-memory.dmp

Filesize
6.9MB

Download
memory/1324-18-0x0000000073A10000-0x00000000740FE000-memory.dmp

Filesize
6.9MB

Download
memory/1324-160-0x0000000009BC0000-0x0000000009D82000-memory.dmp

Filesize
1.8MB

Download
memory/1324-121-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1324-17-0x0000000000950000-0x00000000009AA000-memory.dmp

Filesize
360KB

Download
memory/1324-35-0x0000000008150000-0x000000000825A000-memory.dmp

Filesize
1.0MB

Download
memory/1324-30-0x0000000007A40000-0x0000000007A52000-memory.dmp

Filesize
72KB

Download
memory/1324-29-0x0000000008760000-0x0000000008D66000-memory.dmp

Filesize
6.0MB

Download
memory/1324-23-0x0000000007C50000-0x000000000814E000-memory.dmp

Filesize
5.0MB

Download
memory/1324-25-0x0000000007800000-0x0000000007892000-memory.dmp

Filesize
584KB

Download
memory/1324-26-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/1480-208-0x0000000002E60000-0x0000000002F91000-memory.dmp

Filesize
1.2MB

Download
memory/1480-207-0x0000000002CE0000-0x0000000002E51000-memory.dmp

Filesize
1.4MB

Download
memory/1480-123-0x00007FF66D780000-0x00007FF66D7CE000-memory.dmp

Filesize
312KB

Download
memory/1568-168-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1568-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1568-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-337-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/1888-336-0x00000000072F0000-0x0000000007326000-memory.dmp

Filesize
216KB

Download
memory/1888-334-0x00000000739C0000-0x00000000740AE000-memory.dmp

Filesize
6.9MB

Download
memory/2460-196-0x00000000029F0000-0x0000000002DEA000-memory.dmp

Filesize
4.0MB

Download
memory/2460-212-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2460-226-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2460-149-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2460-145-0x00000000029F0000-0x0000000002DEA000-memory.dmp

Filesize
4.0MB

Download
memory/2460-148-0x0000000002DF0000-0x00000000036DB000-memory.dmp

Filesize
8.9MB

Download
memory/3024-185-0x0000000002A90000-0x0000000002A96000-memory.dmp

Filesize
24KB

Download
memory/3024-230-0x0000000004C40000-0x0000000004D23000-memory.dmp

Filesize
908KB

Download
memory/3024-204-0x0000000004B40000-0x0000000004C3C000-memory.dmp

Filesize
1008KB

Download
memory/3216-167-0x00000000048E0000-0x00000000048F6000-memory.dmp

Filesize
88KB

Download
memory/3216-4-0x0000000000CD0000-0x0000000000CE6000-memory.dmp

Filesize
88KB

Download
memory/3396-180-0x0000000004B40000-0x0000000004C23000-memory.dmp

Filesize
908KB

Download
memory/3396-173-0x0000000004A40000-0x0000000004B3C000-memory.dmp

Filesize
1008KB

Download
memory/3396-67-0x0000000010000000-0x0000000010166000-memory.dmp

Filesize
1.4MB

Download
memory/3396-66-0x0000000000850000-0x0000000000856000-memory.dmp

Filesize
24KB

Download
memory/3396-179-0x0000000004B40000-0x0000000004C23000-memory.dmp

Filesize
908KB

Download
memory/3396-176-0x0000000004B40000-0x0000000004C23000-memory.dmp

Filesize
908KB

Download
memory/3404-124-0x000001A9A5430000-0x000001A9A5532000-memory.dmp

Filesize
1.0MB

Download
memory/3404-126-0x00007FFF4ED50000-0x00007FFF4F73C000-memory.dmp

Filesize
9.9MB

Download
memory/3404-329-0x000001A9A5420000-0x000001A9A5430000-memory.dmp

Filesize
64KB

Download
memory/3404-175-0x000001A9A5420000-0x000001A9A5430000-memory.dmp

Filesize
64KB

Download
memory/3404-352-0x000001A9A5420000-0x000001A9A5430000-memory.dmp

Filesize
64KB

Download
memory/3404-119-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/3404-159-0x000001A9A5420000-0x000001A9A5430000-memory.dmp

Filesize
64KB

Download
memory/3404-184-0x00007FFF4ED50000-0x00007FFF4F73C000-memory.dmp

Filesize
9.9MB

Download
memory/3404-139-0x000001A9A53B0000-0x000001A9A5406000-memory.dmp

Filesize
344KB

Download
memory/3404-174-0x000001A9A5420000-0x000001A9A5430000-memory.dmp

Filesize
64KB

Download
memory/3404-137-0x000001A98B2F0000-0x000001A98B2F8000-memory.dmp

Filesize
32KB

Download
memory/3404-128-0x000001A9A5420000-0x000001A9A5430000-memory.dmp

Filesize
64KB

Download
memory/4404-61-0x0000000073A10000-0x00000000740FE000-memory.dmp

Filesize
6.9MB

Download
memory/4404-146-0x000000000A3B0000-0x000000000A426000-memory.dmp

Filesize
472KB

Download
memory/4404-53-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/4404-62-0x0000000002450000-0x0000000002456000-memory.dmp

Filesize
24KB

Download
memory/4404-155-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/4404-298-0x0000000073A10000-0x00000000740FE000-memory.dmp

Filesize
6.9MB

Download
memory/4404-169-0x000000000B080000-0x000000000B0D0000-memory.dmp

Filesize
320KB

Download
memory/4404-147-0x0000000073A10000-0x00000000740FE000-memory.dmp

Filesize
6.9MB

Download
memory/4404-69-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/4492-131-0x00007FFF4ED50000-0x00007FFF4F73C000-memory.dmp

Filesize
9.9MB

Download
memory/4492-63-0x000001C611E20000-0x000001C611E6C000-memory.dmp

Filesize
304KB

Download
memory/4492-138-0x000001C62A7D0000-0x000001C62A7E0000-memory.dmp

Filesize
64KB

Download
memory/4492-60-0x000001C62A700000-0x000001C62A7D0000-memory.dmp

Filesize
832KB

Download
memory/4492-57-0x000001C62A7D0000-0x000001C62A7E0000-memory.dmp

Filesize
64KB

Download
memory/4492-140-0x00007FFF4ED50000-0x00007FFF4F73C000-memory.dmp

Filesize
9.9MB

Download
memory/4492-54-0x000001C62A7E0000-0x000001C62A8C2000-memory.dmp

Filesize
904KB

Download
memory/4492-52-0x00007FFF4ED50000-0x00007FFF4F73C000-memory.dmp

Filesize
9.9MB

Download
memory/4492-50-0x000001C610130000-0x000001C610216000-memory.dmp

Filesize
920KB

Download
memory/4856-70-0x000001B98E420000-0x000001B98E430000-memory.dmp

Filesize
64KB

Download
memory/4856-87-0x000001B98E520000-0x000001B98E530000-memory.dmp

Filesize
64KB

Download
memory/4856-111-0x000001B98B9E0000-0x000001B98B9E2000-memory.dmp

Filesize
8KB

Download