7e03e3ff3e610e46d60805b84ed0f1dde474abb9b0a37e8e312da3aa463dc489

Analysis

max time kernel
206s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
Size

300KB
MD5

ad7deed52d943a4d44a7c951d3962e45
SHA1

855a2e765685562cc21ac76df95e7b1281ca5850
SHA256

7e03e3ff3e610e46d60805b84ed0f1dde474abb9b0a37e8e312da3aa463dc489
SHA512

2523be981195a97e548b9306d0fec416876fe09b8f82c6df56dda12a5ecf1600137b464dfccae8326b9efcbe0f7ea73456861833610478c827776c5f9bb50035
SSDEEP

3072:vmQZ4mQZ4mQZmGAbjYAiKWDEvB+55/Ho4y6P5sxQ2euRA9oG:xZuZuZe+KWovoP/Ho4BP5wdUh

Score

7^/10

persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2444	exc.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/564-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-1-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-12-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0001000000009e5c-16.dat	upx
behavioral2/memory/564-19-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-31-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00050000000006bd-40.dat	upx
behavioral2/files/0x0001000000009e61-45.dat	upx
behavioral2/files/0x0001000000009e61-43.dat	upx
behavioral2/files/0x000700000001e0b6-55.dat	upx
behavioral2/files/0x000300000001e7e6-52.dat	upx
behavioral2/files/0x00080000000231d2-62.dat	upx
behavioral2/memory/564-65-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-72-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-77-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-98-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-114-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/564-131-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Win32.crAcker.A = "C:\\Windows\\system32\\crAcker.exe"	exc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\CastingShellExt.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dplaysvr.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\AnalogCommonProxyStub.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\Apphlpdm.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dpmodemx.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\AppxProvisioning.xml	exc.exe
File created	C:\WINDOWS\SysWOW64\CoreShellAPI.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\dispex.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\dxmasf.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AcGenral.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\EapTeapExt.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\CameraCaptureUI.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\comctl32.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\DscCoreConfProv.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\ideograf.uce	exc.exe
File created	C:\WINDOWS\SysWOW64\iedkcs32.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\regedit.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\cabinet.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\ieuinit.inf	exc.exe
File created	C:\WINDOWS\SysWOW64\dccw.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\DMAlertListener.ProxyStub.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\input.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\devmgmt.msc	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\BingMaps.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\CHxReadingStringIME.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dpnaddr.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\fc.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\InputSwitch.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\ActivationManager.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\cttunesvr.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\d3dim700.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\dciman32.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dsuiext.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\eappgnui.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\cscapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\findnetprinters.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\CoreMmRes.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dskquoui.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dpnhupnp.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\eventvwr.msc	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\fontview.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\GdiPlus.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\gpscript.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\chkdsk.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\cscobj.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\dot3hc.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dpnaddr.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\appidapi.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\appwiz.cpl	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\dwmapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\elshyph.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\Faultrep.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\drprov.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\gpapi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\accessibilitycpl.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\gpresult.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\crypttpmeksvc.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\dhcpcore.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\Faultrep.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\cmintegrator.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\COLORCNV.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\dhcpcmonitor.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\SysWOW64\archiveint.dll	exc.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\WINDOWS\notepad.exe	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\sysmon.exe	exc.exe
File created	C:\WINDOWS\write.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\explorer.exe	exc.exe
File opened for modification	C:\WINDOWS\lsasetup.log	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File opened for modification	C:\WINDOWS\PFRO.log	exc.exe
File opened for modification	C:\WINDOWS\setuperr.log	exc.exe
File opened for modification	C:\WINDOWS\system.ini	exc.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\splwow64.exe	exc.exe
File opened for modification	C:\WINDOWS\setuperr.log	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\HelpPane.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\hh.exe	exc.exe
File created	C:\WINDOWS\hh.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\mib.bin	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	exc.exe
File opened for modification	C:\WINDOWS\setupact.log	exc.exe
File created	C:\WINDOWS\sysmon.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\explorer.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\WMSysPr9.prx	exc.exe
File created	C:\WINDOWS\write.exe	exc.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	exc.exe
File opened for modification	C:\WINDOWS\setupact.log	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File opened for modification	C:\WINDOWS\win.ini	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\WMSysPr9.prx	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\bfsvc.exe	exc.exe
File created	C:\WINDOWS\notepad.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	exc.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\twain_32.dll	exc.exe
File created	C:\WINDOWS\twain_32.dll	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\HelpPane.exe	exc.exe
File opened for modification	C:\WINDOWS\PFRO.log	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\splwow64.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File opened for modification	C:\WINDOWS\win.ini	exc.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	exc.exe
File created	C:\WINDOWS\winhlp32.exe	exc.exe
File opened for modification	C:\WINDOWS\lsasetup.log	exc.exe
File created	C:\WINDOWS\mib.bin	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File opened for modification	C:\WINDOWS\system.ini	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\winhlp32.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
File created	C:\WINDOWS\bfsvc.exe	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 2444	564	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe	87
PID 564 wrote to memory of 2444	564	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe	87
PID 564 wrote to memory of 2444	564	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe	87
PID 564 wrote to memory of 4736	564	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe	100
PID 564 wrote to memory of 4736	564	NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe	100
PID 2444 wrote to memory of 4312	2444	exc.exe	99
PID 2444 wrote to memory of 4312	2444	exc.exe	99
PID 4736 wrote to memory of 3608	4736	msedge.exe	102
PID 4736 wrote to memory of 3608	4736	msedge.exe	102
PID 4312 wrote to memory of 1464	4312	msedge.exe	101
PID 4312 wrote to memory of 1464	4312	msedge.exe	101
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4692	4312	msedge.exe	103
PID 4312 wrote to memory of 4688	4312	msedge.exe	104
PID 4312 wrote to memory of 4688	4312	msedge.exe	104
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105
PID 4312 wrote to memory of 1612	4312	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ad7deed52d943a4d44a7c951d3962e45_JC.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:564
- C:\exc.exe
  "C:\exc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbc35546f8,0x7ffbc3554708,0x7ffbc3554718
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16182681666205409145,3136525738831071746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc35546f8,0x7ffbc3554708,0x7ffbc3554718
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12747850352253180422,8399746394558911125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12747850352253180422,8399746394558911125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c126b33f65b7fc4ece66e42d6802b02e

SHA1
2a169a1c15e5d3dab708344661ec04d7339bcb58

SHA256
ca9d2a9ab8047067c8a78be0a7e7af94af34957875de8e640cf2f98b994f52d8

SHA512
eecbe3f0017e902639e0ecb8256ae62bf681bb5f80a7cddc9008d2571fe34d91828dfaee9a8df5a7166f337154232b9ea966c83561ace45d1e2923411702e822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
881b0108f2cd7dae1cde4bcb5993c370

SHA1
f127692311d797a37e6095852796d2b7f142cdd8

SHA256
411dc7e4183f3fc7dfa64483add85c5fdd89376801f4e3351fc19bd716e9ceee

SHA512
ad7bb81aa0f5e57a24f128c08a3ddb0c82d5762674447dc4332e7ec77e03a92406203084ecdc5a9a097757b93227ad64e1f1d7203a301e6cc9e25a30248d77ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
9fe9cc59444d91761cc8651963e56878

SHA1
46e9fc04c2fc7b682d6a528a8f76f9dbe52cfe3c

SHA256
726a255e97c3aae1c47c4a947af704658d340e25a5d9d33f454783b9daf979b3

SHA512
560726a31c17ba59975e77044e868b930858d762dfd4d87efacbd3d9ef813d6b9d280a59af54d9aa649a308167fd4f67cb20d0182b29957119e7ff39881cea02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
9fe9cc59444d91761cc8651963e56878

SHA1
46e9fc04c2fc7b682d6a528a8f76f9dbe52cfe3c

SHA256
726a255e97c3aae1c47c4a947af704658d340e25a5d9d33f454783b9daf979b3

SHA512
560726a31c17ba59975e77044e868b930858d762dfd4d87efacbd3d9ef813d6b9d280a59af54d9aa649a308167fd4f67cb20d0182b29957119e7ff39881cea02

Download Submit
C:\WINDOWS\DtcInstall.log

Filesize
29KB

MD5
2623e471a83cd509445b8626d463a401

SHA1
63316d61a639dd22a4943ec9b9dd01f892752fbd

SHA256
8999b47d8616ecd3a7abf1a9bfeb8149cf05d91d5ce3337748e279babda65c65

SHA512
08bd36c2d2a7b7f56a40273271cb0966f14160f354cdb2b4c4e4aa0dddaddf3a4d3197a9ba5e9aeac9e1310ac000d6fc788e69d4084695f814e1e83c42aafa8e

Download Submit
C:\WINDOWS\PFRO.log

Filesize
28KB

MD5
c91deae49dd8e7a77114a2bdbed7d35d

SHA1
8b6c263f930a06b2c6e62090ee1a19bb17bf1a18

SHA256
9b6a741c25427bae93360e4e373d1122e7e8f68882c1867eff2e1167a990605c

SHA512
8c8c46bca2cd1e0e63f680a2635fe39e8d6d88a5e283e8048185f955668794d6330a54eaa580c4a1ca0adc3025bfa0896818d99b2b62e122be6a2af42ca97e76

Download Submit
C:\WINDOWS\Professional.xml

Filesize
57KB

MD5
31fcae9817b20b6355269977f4de7a72

SHA1
acb2ff99ba0539bb6c4102cac0f427f330883c59

SHA256
0452d4731f215d71d2440971ed10527786d20992a8bed49e0a897b24eae773e2

SHA512
cadc322c42b691c6858c538fdb715647a96eb98ca0a13d49cec5092d75d3a4e1f5d5b3bba6191c985819073d32dd55705060077c7f9c28b5a5d802d460b064b4

Download Submit
C:\WINDOWS\SysWOW64\atl100.dll

Filesize
162KB

MD5
a764c94a2a97e85658924d5835c25d2b

SHA1
58745a3f3fafb8d92a9f257257dacee42c8aaccb

SHA256
856711b9dbd9f565cc97af3cea94eba98f49717c8a6691a0d8cd6b2ac065603b

SHA512
723514205793f6755fb4250f66071889f45515eb3059384c66789f9cafefa3230a8c5739cfa6379f01120d0566fdfe0f2c92738c9b4a9350af967d5f9034c919

Download Submit
C:\WINDOWS\SysWOW64\atl110.dll

Filesize
188KB

MD5
46ca9f16ba7e33be7a174508ed2ecf61

SHA1
0ae719744ef5f25cf5cb05d356767288fa598758

SHA256
470b35d0972dcd56ac65bd4834f48b2e2159c4264992b8dc5d563225a353d700

SHA512
14a5f69b2e12686e8af96123bf8067a001127c3197d5e1f32f540a25b1c7f98604276bafedf281c164254d32a0300ba122ded361d2aa7f3b514fd942d7c7744f

Download Submit
C:\WINDOWS\SysWOW64\concrt140.dll

Filesize
269KB

MD5
36dd01485576e96f704cd50377740165

SHA1
b6194ce7734373e0909b14f626c1be96f82182e2

SHA256
57f43ff064b9712acde3b179894030cb6725a3a8a3dbfaa9fd8b5c8c122e64f8

SHA512
210012750dfb0b738d9524eaefd3709699d05803c48e45b470e8e844c16ef5c40d06f09393598d46d0520958bef0b5be25639fe84e6b9c5447d8d163585394c2

Download Submit
C:\WINDOWS\SysWOW64\crAcker.exe

Filesize
328KB

MD5
49c77daa2753cf0a8c253a409f0463f1

SHA1
5382845d6f596b9b70b4b2e3692375f6ea27ac5a

SHA256
d58a2765449564eb426be4aefdaff7631a1b86c90cfc5038deeb38a0e736820e

SHA512
1c44ce562cce33777a2138afadcb1bf9b70cca9d6ad559f7c4ee9facde83eb3f63f538bbb4cf271656ee7628fdae3ccfa513a86e161420852c13d0da09a2ced7

Download Submit
C:\WINDOWS\SysWOW64\dssec.dat

Filesize
238KB

MD5
ea7a37d8982f0bb481279dbf377b17ef

SHA1
12b034b009c11b16dcf2f5e987899ed3ed0b178a

SHA256
8d711ef5b900a080f7b2bc8700912d9cbc48038b6971d17a6f37727328a4cb6f

SHA512
d7aacabf346dee225ca6ab508139e828789a22c635ba92c31db94d4e414ebed7fad5d596497dd68bf090197e94ff9a2c4b2bf8e00616c9324daf0e57625d7ca3

Download Submit
C:\WINDOWS\SysmonDrv.sys

Filesize
193KB

MD5
53a000579cd3ace7d6b30ff91e345d99

SHA1
57283d430271f81ea27f1f4d3eed0714c4edbe5d

SHA256
994a20361b7b01273bfaa631b3961feb11e54ad1bdf0d8b31a43b08045ca11bd

SHA512
b1b84cc26957e6de0063168391cea74d0aeb583cde850e6688c1399243cd02e34ca8046abb2bc89d7501fbb1cecd3e52e848c304365faf9a2d248ceed02f5e13

Download Submit
C:\WINDOWS\lsasetup.log

Filesize
28KB

MD5
029dc84892fb419b2b4d5992dd7a1f17

SHA1
3b1af7f7b07ed32b080f0c1073b5468793575b0b

SHA256
400b06c826fcacb9199fe2776ab054441fb45e3417c6140ad3759889d59cfeaa

SHA512
0520e079ec3aba3dcd7213b0f894cc6453424eece3f1daea0cbd0ae65bf73baf4df38a0b07a9808461e97fa406683f559246afec3538748f632f7a29dcd86143

Download Submit
C:\WINDOWS\setupact.log

Filesize
28KB

MD5
edb55f0bae0a54be1ffd02ee95e2717c

SHA1
bc052ae76f76bdf850e4388f047c92d83e4483b2

SHA256
18e1373ff8299e1cdd87675fab066289937f4a1c9156cd0bf3ee5950a7daa150

SHA512
a7c965861ca81c63826376211884b7d4b2a5d6b69d7285eeb18cbe7e154afc8da9153537f2ce1a830f5f3a050e79a756113bc270d7a702302d92f7767c19c5a7

Download Submit
C:\WINDOWS\setuperr.log

Filesize
55KB

MD5
b7adc2bcb5074f08a709c1537b889659

SHA1
20d8969dda8f5025ab9c63c8cd24dc56ce11fa9d

SHA256
6904adfb5c51ab9801e84254b44833f52eccc97191db7646396722f427cbd372

SHA512
6dd2672defcf714fbd4a22c6928c7af7c85eff7fb429b1ace01fa72a03f2ac8a64fa1b05aaaa5d28e20912684c9936bcfd450d8bae53778429d7fdea92317ee9

Download Submit
C:\WINDOWS\system.ini

Filesize
55KB

MD5
bff6fcebf11699bd70fb0253469f1c38

SHA1
0b1d5575aa26a17ec036463ac06323e8a0794bc5

SHA256
bfb7da6520870d5675396f33ce183dc99a93c41a85ac3dcbe5c60093abd2ae36

SHA512
ed0b9690077a31ffcfe09bf5c95937fe59701c21eb78f84b637606ceb9aceee2a32da1d0dc127e61390b121838817bc9b0620dd93d8e4fbd001025076f5d832f

Download Submit
C:\Windows\system.ini

Filesize
55KB

MD5
bff6fcebf11699bd70fb0253469f1c38

SHA1
0b1d5575aa26a17ec036463ac06323e8a0794bc5

SHA256
bfb7da6520870d5675396f33ce183dc99a93c41a85ac3dcbe5c60093abd2ae36

SHA512
ed0b9690077a31ffcfe09bf5c95937fe59701c21eb78f84b637606ceb9aceee2a32da1d0dc127e61390b121838817bc9b0620dd93d8e4fbd001025076f5d832f

Download Submit
C:\exc.exe

Filesize
272KB

MD5
677950c38d393f8b93afe07a3a962a98

SHA1
59be552227cfff1c3857a01ebece0531d09d531c

SHA256
7e7528c5be66cf23e9f6b3226243b3265878a6c926307c64e160e242de36bac9

SHA512
bae13c84787e56c5f804e1d670795e44d4e8247b7378fa966b6e48c4d7e54c736882abe3a493b77495b46b348aa2395ec78a9e214b794fe6f5bd750b94fe619d

Download Submit
C:\exc.exe

Filesize
272KB

MD5
677950c38d393f8b93afe07a3a962a98

SHA1
59be552227cfff1c3857a01ebece0531d09d531c

SHA256
7e7528c5be66cf23e9f6b3226243b3265878a6c926307c64e160e242de36bac9

SHA512
bae13c84787e56c5f804e1d670795e44d4e8247b7378fa966b6e48c4d7e54c736882abe3a493b77495b46b348aa2395ec78a9e214b794fe6f5bd750b94fe619d

Download Submit
C:\exc.exe

Filesize
272KB

MD5
677950c38d393f8b93afe07a3a962a98

SHA1
59be552227cfff1c3857a01ebece0531d09d531c

SHA256
7e7528c5be66cf23e9f6b3226243b3265878a6c926307c64e160e242de36bac9

SHA512
bae13c84787e56c5f804e1d670795e44d4e8247b7378fa966b6e48c4d7e54c736882abe3a493b77495b46b348aa2395ec78a9e214b794fe6f5bd750b94fe619d

Download Submit
memory/564-114-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-131-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-72-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-19-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-77-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-31-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-98-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2444-29-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-97-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-108-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-76-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-71-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-69-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-121-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-64-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-18-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2444-13-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download