amadey | 38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43

Analysis

max time kernel
58s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe
Size

1.5MB
MD5

3e0b82027e18879f115eebfb8bae5900
SHA1

1c37b25f847f2d2d4ae7067ba4107a62d5ed2cb4
SHA256

38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43
SHA512

941793ff02a98b3dbe9965c801572ea882a00d7ef5f1843ded8aa8d8e5d8bab8091b2ab8eb024e7617713ee482fa97fe4a524337929ff1d15db657ab12d853b2
SSDEEP

24576:4yPhFpn+lUmXzdDsZnY4UR16cyOEpaCctzt4ctcIBKntf9LcU1lhhSOhsrR:/Zn+7Xzl1bybpMtza8IPhhSO

Score

10^/10

amadey redline smokeloader grome kinza up3 backdoor evasion infostealer persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Extracted

Family

smokeloader

Botnet

up3

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 8 IoCs

resource	yara_rule
behavioral1/memory/2836-54-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/files/0x0007000000022dd6-336.dat	family_redline
behavioral1/files/0x0007000000022dd6-337.dat	family_redline
behavioral1/memory/3356-361-0x00000000020C0000-0x000000000211A000-memory.dmp	family_redline
behavioral1/memory/5068-385-0x0000000000590000-0x00000000005CE000-memory.dmp	family_redline
behavioral1/memory/3356-391-0x0000000000400000-0x000000000047E000-memory.dmp	family_redline
behavioral1/memory/6008-628-0x0000000000550000-0x00000000005AA000-memory.dmp	family_redline
behavioral1/memory/5456-663-0x0000000000C20000-0x0000000000C7A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	5FL4By6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	6Xv4KJ7.exe

Executes dropped EXE 11 IoCs

pid	Process
4996	Xg1yq51.exe
4212	CO2Sf32.exe
1544	UE8nB31.exe
4116	vt0BW41.exe
492	1Kg42xs0.exe
884	2Iz1253.exe
3768	3PV81jF.exe
4408	4Pf260EL.exe
1464	5FL4By6.exe
1644	explothe.exe
4720	6Xv4KJ7.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	UE8nB31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	vt0BW41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Xg1yq51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	CO2Sf32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 492 set thread context of 5060	492	1Kg42xs0.exe	85
PID 4408 set thread context of 2836	4408	4Pf260EL.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3464	3356	WerFault.exe	145
2228	4920	WerFault.exe	153

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3PV81jF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3PV81jF.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3PV81jF.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3496	schtasks.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5060	AppLaunch.exe
5060	AppLaunch.exe
3768	3PV81jF.exe
3768	3PV81jF.exe
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3768	3PV81jF.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	AppLaunch.exe
Token: SeShutdownPrivilege	3232	Process not Found
Token: SeCreatePagefilePrivilege	3232	Process not Found
Token: SeShutdownPrivilege	3232	Process not Found
Token: SeCreatePagefilePrivilege	3232	Process not Found
Token: SeShutdownPrivilege	3232	Process not Found
Token: SeCreatePagefilePrivilege	3232	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4996	1588	38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe	80
PID 1588 wrote to memory of 4996	1588	38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe	80
PID 1588 wrote to memory of 4996	1588	38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe	80
PID 4996 wrote to memory of 4212	4996	Xg1yq51.exe	81
PID 4996 wrote to memory of 4212	4996	Xg1yq51.exe	81
PID 4996 wrote to memory of 4212	4996	Xg1yq51.exe	81
PID 4212 wrote to memory of 1544	4212	CO2Sf32.exe	82
PID 4212 wrote to memory of 1544	4212	CO2Sf32.exe	82
PID 4212 wrote to memory of 1544	4212	CO2Sf32.exe	82
PID 1544 wrote to memory of 4116	1544	UE8nB31.exe	83
PID 1544 wrote to memory of 4116	1544	UE8nB31.exe	83
PID 1544 wrote to memory of 4116	1544	UE8nB31.exe	83
PID 4116 wrote to memory of 492	4116	vt0BW41.exe	84
PID 4116 wrote to memory of 492	4116	vt0BW41.exe	84
PID 4116 wrote to memory of 492	4116	vt0BW41.exe	84
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 492 wrote to memory of 5060	492	1Kg42xs0.exe	85
PID 4116 wrote to memory of 884	4116	vt0BW41.exe	86
PID 4116 wrote to memory of 884	4116	vt0BW41.exe	86
PID 4116 wrote to memory of 884	4116	vt0BW41.exe	86
PID 1544 wrote to memory of 3768	1544	UE8nB31.exe	87
PID 1544 wrote to memory of 3768	1544	UE8nB31.exe	87
PID 1544 wrote to memory of 3768	1544	UE8nB31.exe	87
PID 4212 wrote to memory of 4408	4212	CO2Sf32.exe	88
PID 4212 wrote to memory of 4408	4212	CO2Sf32.exe	88
PID 4212 wrote to memory of 4408	4212	CO2Sf32.exe	88
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4408 wrote to memory of 2836	4408	4Pf260EL.exe	89
PID 4996 wrote to memory of 1464	4996	Xg1yq51.exe	90
PID 4996 wrote to memory of 1464	4996	Xg1yq51.exe	90
PID 4996 wrote to memory of 1464	4996	Xg1yq51.exe	90
PID 1464 wrote to memory of 1644	1464	5FL4By6.exe	91
PID 1464 wrote to memory of 1644	1464	5FL4By6.exe	91
PID 1464 wrote to memory of 1644	1464	5FL4By6.exe	91
PID 1588 wrote to memory of 4720	1588	38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe	92
PID 1588 wrote to memory of 4720	1588	38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe	92
PID 1588 wrote to memory of 4720	1588	38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe	92
PID 1644 wrote to memory of 3496	1644	explothe.exe	93
PID 1644 wrote to memory of 3496	1644	explothe.exe	93
PID 1644 wrote to memory of 3496	1644	explothe.exe	93
PID 1644 wrote to memory of 2316	1644	explothe.exe	124
PID 1644 wrote to memory of 2316	1644	explothe.exe	124
PID 1644 wrote to memory of 2316	1644	explothe.exe	124
PID 4720 wrote to memory of 5088	4720	6Xv4KJ7.exe	97
PID 4720 wrote to memory of 5088	4720	6Xv4KJ7.exe	97
PID 2316 wrote to memory of 3948	2316	msedge.exe	99
PID 2316 wrote to memory of 3948	2316	msedge.exe	99
PID 2316 wrote to memory of 3948	2316	msedge.exe	99
PID 2316 wrote to memory of 4368	2316	msedge.exe	100
PID 2316 wrote to memory of 4368	2316	msedge.exe	100
PID 2316 wrote to memory of 4368	2316	msedge.exe	100
PID 2316 wrote to memory of 4952	2316	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe
"C:\Users\Admin\AppData\Local\Temp\38ea08f5ab38025d3f98bcb70c1c8e2092ae30f2c2d94c43b89d46b3c8e5cc43.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xg1yq51.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xg1yq51.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CO2Sf32.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CO2Sf32.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UE8nB31.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UE8nB31.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vt0BW41.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vt0BW41.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kg42xs0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kg42xs0.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:492
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Iz1253.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Iz1253.exe
        6⤵
        Executes dropped EXE
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3PV81jF.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3PV81jF.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Pf260EL.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Pf260EL.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5FL4By6.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5FL4By6.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
      "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3496
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:2316
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3948
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        6⤵
        
        PID:4368
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4140
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        6⤵
        
        PID:2268
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        6⤵
        
        PID:3536
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Xv4KJ7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Xv4KJ7.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3A.tmp\3B.tmp\3C.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Xv4KJ7.exe"
    3⤵
    PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:4360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff8adab46f8,0x7ff8adab4708,0x7ff8adab4718
        5⤵
        
        PID:2012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2080431156532117619,9563265351800968340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        5⤵
        
        PID:1616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2080431156532117619,9563265351800968340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        
        PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8adab46f8,0x7ff8adab4708,0x7ff8adab4718
        5⤵
        
        PID:4380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:3468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
        5⤵
        
        PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
        5⤵
        
        PID:1556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
        5⤵
        
        PID:1096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
        5⤵
        
        PID:1932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
        5⤵
        
        PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
        5⤵
        
        PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
        5⤵
        
        PID:1552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
        5⤵
        
        PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
        5⤵
        
        PID:2460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
        5⤵
        
        PID:748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12892537927776745593,3157354720900889064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
        5⤵
        
        PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:4796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x88,0x170,0x7ff8adab46f8,0x7ff8adab4708,0x7ff8adab4718
        5⤵
        
        PID:5044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,17736865927981552143,7334308054277714965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        5⤵
        
        PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

C:\Users\Admin\AppData\Local\Temp\407F.exe
C:\Users\Admin\AppData\Local\Temp\407F.exe
1⤵
PID:1632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iH8ya6MS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iH8ya6MS.exe
  2⤵
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ea1TY8js.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ea1TY8js.exe
    3⤵
    PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WZ7WR7iX.exe
      C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WZ7WR7iX.exe
      4⤵
      PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ie6Kf5fU.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ie6Kf5fU.exe
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2St902oJ.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2St902oJ.exe
        6⤵
        
        PID:5068

C:\Users\Admin\AppData\Local\Temp\411C.exe
C:\Users\Admin\AppData\Local\Temp\411C.exe
1⤵
PID:3464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4217.bat" "
1⤵
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8adab46f8,0x7ff8adab4708,0x7ff8adab4718
    3⤵
    PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8adab46f8,0x7ff8adab4708,0x7ff8adab4718
    3⤵
    PID:3464

C:\Users\Admin\AppData\Local\Temp\437F.exe
C:\Users\Admin\AppData\Local\Temp\437F.exe
1⤵
PID:4172

C:\Users\Admin\AppData\Local\Temp\4517.exe
C:\Users\Admin\AppData\Local\Temp\4517.exe
1⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1rD20ay6.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1rD20ay6.exe
1⤵
PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 540
    3⤵
    - Program crash
    PID:2228

C:\Users\Admin\AppData\Local\Temp\46AE.exe
C:\Users\Admin\AppData\Local\Temp\46AE.exe
1⤵
PID:4108

C:\Users\Admin\AppData\Local\Temp\4910.exe
C:\Users\Admin\AppData\Local\Temp\4910.exe
1⤵
PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 792
  2⤵
  - Program crash
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3356 -ip 3356
1⤵
PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4920 -ip 4920
1⤵
PID:700

C:\Users\Admin\AppData\Local\Temp\8223.exe
C:\Users\Admin\AppData\Local\Temp\8223.exe
1⤵
PID:5536
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  PID:5688
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    PID:5920
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:5748
- C:\Users\Admin\AppData\Local\Temp\kos2.exe
  "C:\Users\Admin\AppData\Local\Temp\kos2.exe"
  2⤵
  PID:5820
- - C:\Users\Admin\AppData\Local\Temp\set16.exe
    "C:\Users\Admin\AppData\Local\Temp\set16.exe"
    3⤵
    PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\is-VPMKS.tmp\is-1A32I.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VPMKS.tmp\is-1A32I.tmp" /SL4 $C019E "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1281875 52224
      4⤵
      PID:3596
    - - C:\Program Files (x86)\MyBurn\MyBurn.exe
        
        "C:\Program Files (x86)\MyBurn\MyBurn.exe" -i
        5⤵
        
        PID:5432
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 20
        5⤵
        
        PID:5404
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 20
        6⤵
        
        PID:5796
    - - C:\Program Files (x86)\MyBurn\MyBurn.exe
        
        "C:\Program Files (x86)\MyBurn\MyBurn.exe" -s
        5⤵
        
        PID:5816
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Query
        5⤵
        
        PID:5808
- - C:\Users\Admin\AppData\Local\Temp\K.exe
    "C:\Users\Admin\AppData\Local\Temp\K.exe"
    3⤵
    PID:6112
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  PID:5912

C:\Users\Admin\AppData\Local\Temp\8418.exe
C:\Users\Admin\AppData\Local\Temp\8418.exe
1⤵
PID:5580

C:\Users\Admin\AppData\Local\Temp\8987.exe
C:\Users\Admin\AppData\Local\Temp\8987.exe
1⤵
PID:5828

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
PID:5968

C:\Users\Admin\AppData\Local\Temp\8F74.exe
C:\Users\Admin\AppData\Local\Temp\8F74.exe
1⤵
PID:6008

C:\Users\Admin\AppData\Local\Temp\9A91.exe
C:\Users\Admin\AppData\Local\Temp\9A91.exe
1⤵
PID:4600
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe baebdacabb.sys,#1
  2⤵
  PID:5508
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe baebdacabb.sys,#1
    3⤵
    PID:5552

C:\Users\Admin\AppData\Local\Temp\A01F.exe
C:\Users\Admin\AppData\Local\Temp\A01F.exe
1⤵
PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6008 -ip 6008
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8992ae6e99b277eea6fb99c4f267fa3f

SHA1
3715825c48f594068638351242fac7fdd77c1eb7

SHA256
525038333c02dff407d589fa407b493b7962543e205c587feceefbc870a08e3d

SHA512
a1f44fff4ea76358c7f2a909520527ec0bbc3ddcb722c5d1f874e03a0c4ac42dac386a49ccf72807ef2fa6ccc534490ad90de2f699b1e49f06f79157f251ab25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b5f40cef98ca18eefdc91fc773c2b3a

SHA1
dd8643af0f78b65004e25ecd547ffa1eafd61afc

SHA256
005b7cdf2b7d7afe094e1b95344e925763506826390ffcfa76cba9e3dcf31898

SHA512
cd8b8abbc310e41c6c2b85c2edad3f41b5a03504ac2702b7cfd247b2065a3800b4a531339a4efd4abc7b8db22632572efabe53f23445a4749e84cf0c459fd383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f045c68e619122779836543db23c08b

SHA1
5d66cfead8398fbab9593ba1c2b1e91684179c20

SHA256
25e89876773564c1b1ca48807406bac15bb607cfd0d07fde778375e04b2b5949

SHA512
59be7ea9f5607da8b9162ddefde316917ad7a717da71bf81d3a2e36f8e257ce8af1d662d770f7e7fca2b86a2931f9fdede4d49326a016b8a3d17ca86e6bb9321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d21fbcd44ac3a6057032a0fd197e99dc

SHA1
770715ca22aea4b82ce69df08a9f6daad4bf8602

SHA256
00c3901ca66cd5e2320ef7a4ae33ec597b36e144ae39c4b558f1285fc38236f6

SHA512
dfa017889f4931cc95e551ea642be41dcc03eb83febc441c2063d1a50ca2dad9fed84bb877c3fa6c8a1e9593ee38535efc88f499f65f1f40fd35fae5833a4970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b9f9a6c775c26c9a25a445b08c4f2d7b

SHA1
ae35d7022f4113d79d5c87e3d0c71f3f9ed68fac

SHA256
f6a188b0e04968b4b7fe7476eac9295c48eae4b1f002d176d9a4757d33d166a8

SHA512
e71e8ccd9770192170665b3ee951698b883892885e4f928bcaf1a8d01657afda6fec37df7a20431d2aca60536c0b574c5e9cccaf024cf2d846dd7ec2fc67cbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587fd9.TMP

Filesize
1KB

MD5
2d4432da39fe852ce42a5ce199a8b420

SHA1
2d58d00d31eafb9454bfaedc49332e02c4d3ab04

SHA256
006c8d8115e7a8d8975c225088cb6c00e189aab778d18c5995e807f26c333acb

SHA512
b872b91a528310703d7ca943ff7cc4c7fa2c1d1a0e94937c8a8587d70735c8852e80bff5b2adb8fa6201d3cffe03c51729a68177903718ba705e86e7bd039fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
65b04e4622467cf7f705a081670b9c5b

SHA1
4b9255b7a7c1a9bf62a765fd9c690cecbb445506

SHA256
4e7bf10d57a87131485c5d01562a0418262bfd2d474915d207bc2f8d1df864bd

SHA512
170d3413868a9a687985ee2fa5f3a4e11156dd3d6db2543374604a0b8e758a7d75769164a6cd7878003c88e28f39c02f1e490db26113673525bf7877ed44ed46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
65b04e4622467cf7f705a081670b9c5b

SHA1
4b9255b7a7c1a9bf62a765fd9c690cecbb445506

SHA256
4e7bf10d57a87131485c5d01562a0418262bfd2d474915d207bc2f8d1df864bd

SHA512
170d3413868a9a687985ee2fa5f3a4e11156dd3d6db2543374604a0b8e758a7d75769164a6cd7878003c88e28f39c02f1e490db26113673525bf7877ed44ed46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
692bdc9fc4070c28125e75681e3c6ddf

SHA1
f5b7437f36c8576b658e42281bf61e4af0965cb5

SHA256
f03eb3fb1940bc0e6ae8cd5f2c37e3c49f016d55998b0a48118a5ec722703ffa

SHA512
1ee7c5587044ceda7854473865c44d5eaed2c5107587507e647949c32bdf209a27382cfe00ebded220535a62f051dcbbf50a87762ab07a88d1c5a1dd5683ac18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
692bdc9fc4070c28125e75681e3c6ddf

SHA1
f5b7437f36c8576b658e42281bf61e4af0965cb5

SHA256
f03eb3fb1940bc0e6ae8cd5f2c37e3c49f016d55998b0a48118a5ec722703ffa

SHA512
1ee7c5587044ceda7854473865c44d5eaed2c5107587507e647949c32bdf209a27382cfe00ebded220535a62f051dcbbf50a87762ab07a88d1c5a1dd5683ac18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
692bdc9fc4070c28125e75681e3c6ddf

SHA1
f5b7437f36c8576b658e42281bf61e4af0965cb5

SHA256
f03eb3fb1940bc0e6ae8cd5f2c37e3c49f016d55998b0a48118a5ec722703ffa

SHA512
1ee7c5587044ceda7854473865c44d5eaed2c5107587507e647949c32bdf209a27382cfe00ebded220535a62f051dcbbf50a87762ab07a88d1c5a1dd5683ac18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5cf57dac11e2f869a2069f2685bfee6b

SHA1
edbebf3adb107a701382b6646dc382a41a0caff6

SHA256
6329cdd8f831bb7da22c383b21a25174b80e517830472847fb2fd2a80d300f18

SHA512
91cb204d38c6e71d24463e5b6a06389b03b00a72922ec7268575b0403a030be76b8598825bbfd41ffea5cf3d665097f1e7565a6b5c5f666be37db860b2863d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
65b04e4622467cf7f705a081670b9c5b

SHA1
4b9255b7a7c1a9bf62a765fd9c690cecbb445506

SHA256
4e7bf10d57a87131485c5d01562a0418262bfd2d474915d207bc2f8d1df864bd

SHA512
170d3413868a9a687985ee2fa5f3a4e11156dd3d6db2543374604a0b8e758a7d75769164a6cd7878003c88e28f39c02f1e490db26113673525bf7877ed44ed46

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
ea6cb5dbc7d10b59c3e1e386b2dbbab5

SHA1
578a5b046c316ccb2ce6f4571a1a6f531f41f89c

SHA256
443d03b8d3a782b2020740dc49c5cc97eb98ca4543b94427a0886df3f2a71132

SHA512
590355ea716bac8372d0fac1e878819f2e67d279e32ef787ff11cbe8a870e04d1a77233e7f9f29d303ff11a90096ebae6c5a41f1ab94abb82c0710357fc23200

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A.tmp\3B.tmp\3C.bat

Filesize
568B

MD5
bcbb9cb105a5466367c5f6ceb38e614a

SHA1
be7f3382e1a4a78428c8285e961c65cefb98affb

SHA256
878c05348c1269420ec01dd070212589b5118eba58a4592f89fc36b2a5860d8d

SHA512
efed12dc71ded17bde4a2f7849ef77d80db75d29c52351f6338f4a9ab5d8b42ba7b9fdca7eb472866819749587f79eb3c6b73e0398f4813b51f300d9a65b0fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\407F.exe

Filesize
1.7MB

MD5
966df4988355243f8e9c685368d71fc0

SHA1
c8920f8c27c046c3927544b2ca8a912a9641b314

SHA256
c8957f4e4704ab9d4a55c4c27a57082d80c19f30da62f0ad33bb61d1ca931104

SHA512
0395f97ded00616e2971184edda7eb0ec10731784029c3774da9141764afecada23d134685f1d31cb85248b34c81b07a7a4c0075d0de931cef50aa86a36233cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\407F.exe

Filesize
1.7MB

MD5
966df4988355243f8e9c685368d71fc0

SHA1
c8920f8c27c046c3927544b2ca8a912a9641b314

SHA256
c8957f4e4704ab9d4a55c4c27a57082d80c19f30da62f0ad33bb61d1ca931104

SHA512
0395f97ded00616e2971184edda7eb0ec10731784029c3774da9141764afecada23d134685f1d31cb85248b34c81b07a7a4c0075d0de931cef50aa86a36233cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\411C.exe

Filesize
180KB

MD5
0635bc911c5748d71a4aed170173481e

SHA1
6d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b

SHA256
a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1

SHA512
50ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a

Download Submit
C:\Users\Admin\AppData\Local\Temp\411C.exe

Filesize
180KB

MD5
0635bc911c5748d71a4aed170173481e

SHA1
6d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b

SHA256
a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1

SHA512
50ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a

Download Submit
C:\Users\Admin\AppData\Local\Temp\411C.exe

Filesize
180KB

MD5
0635bc911c5748d71a4aed170173481e

SHA1
6d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b

SHA256
a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1

SHA512
50ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a

Download Submit
C:\Users\Admin\AppData\Local\Temp\437F.exe

Filesize
221KB

MD5
73089952a99d24a37d9219c4e30decde

SHA1
8dfa37723afc72f1728ec83f676ffeac9102f8bd

SHA256
9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60

SHA512
7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\437F.exe

Filesize
221KB

MD5
73089952a99d24a37d9219c4e30decde

SHA1
8dfa37723afc72f1728ec83f676ffeac9102f8bd

SHA256
9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60

SHA512
7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Xv4KJ7.exe

Filesize
87KB

MD5
428753e8c9311dce419ea8b6d286c5a6

SHA1
949593df18c531e7394fc67857f7029c6246195a

SHA256
d72dee49b584b64ad17d212722eca94304206ca0cee7d63d00bcb68c6f5b3afc

SHA512
b0756ef20c47e2231b47e96be3d982e1d0fac8832a281eb92ee5cf807c62139e93e5a816ca674da799740a17ec42aaa18d84a4297e2f6cb560e262c7bc1ce311

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Xv4KJ7.exe

Filesize
87KB

MD5
428753e8c9311dce419ea8b6d286c5a6

SHA1
949593df18c531e7394fc67857f7029c6246195a

SHA256
d72dee49b584b64ad17d212722eca94304206ca0cee7d63d00bcb68c6f5b3afc

SHA512
b0756ef20c47e2231b47e96be3d982e1d0fac8832a281eb92ee5cf807c62139e93e5a816ca674da799740a17ec42aaa18d84a4297e2f6cb560e262c7bc1ce311

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6sP42NY.exe

Filesize
87KB

MD5
cb182588e06f96f2be52f5e785a84747

SHA1
afc17091e306cce8d23f2043356a4addb5c446ff

SHA256
6e5171767404d61f8b7297a9413f4bb1be1713c7c19489c94b0e6462b7960a5c

SHA512
3a8629b9fa517bf8cea1e27a9fabdb181b995bc8beee19d5a23c617ceb52241036801b917835778ec20501c75d51711febfd1f63f83c4820b12359261781caa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xg1yq51.exe

Filesize
1.4MB

MD5
a4c7c013eea9f38d4640acf755e1dbd2

SHA1
ffbe0849d777290cad64c90c3e6d8385df5e4257

SHA256
5c717fe57ab35828f06dc6b5e21ac4f37af1166948740d85095022f7bc0b8eb5

SHA512
9fe25b3662e41eb3c98fd7d5ad4fb61e479db82c5f5fdb1e8a49b87442981e0ff30ed45b5d71fd41e5c8b888bee489f8afa4ae60621291c3aa1fc7ad095c549a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xg1yq51.exe

Filesize
1.4MB

MD5
a4c7c013eea9f38d4640acf755e1dbd2

SHA1
ffbe0849d777290cad64c90c3e6d8385df5e4257

SHA256
5c717fe57ab35828f06dc6b5e21ac4f37af1166948740d85095022f7bc0b8eb5

SHA512
9fe25b3662e41eb3c98fd7d5ad4fb61e479db82c5f5fdb1e8a49b87442981e0ff30ed45b5d71fd41e5c8b888bee489f8afa4ae60621291c3aa1fc7ad095c549a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iH8ya6MS.exe

Filesize
1.5MB

MD5
f18148ba63e4697bd0e319748df771f4

SHA1
f209c0d5ebed89af2991983863e2d592b30de6a7

SHA256
f695da5e055ec994745a57288bab24333cd7638d62ccbe8a6aad1da0595b30ed

SHA512
3115b1020f1cc9a37e30d804d59fe56dc43548cf9464273594c3fa70a21ebf38f57f09963af3c3ee63b88e484f0b6eda37972ae8558b6b01e674fea579d8913e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iH8ya6MS.exe

Filesize
1.5MB

MD5
f18148ba63e4697bd0e319748df771f4

SHA1
f209c0d5ebed89af2991983863e2d592b30de6a7

SHA256
f695da5e055ec994745a57288bab24333cd7638d62ccbe8a6aad1da0595b30ed

SHA512
3115b1020f1cc9a37e30d804d59fe56dc43548cf9464273594c3fa70a21ebf38f57f09963af3c3ee63b88e484f0b6eda37972ae8558b6b01e674fea579d8913e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5FL4By6.exe

Filesize
219KB

MD5
1e26039fc4c8fef8150f57c09af75c48

SHA1
4119080c2932a7bfa06d50c936523dc571e4a200

SHA256
641b003e3fa92e55ad5c9788d52211a11c8aa8577b7de433e5c3f18631c288e1

SHA512
5cd691395f150bf9d820a616105395f6d96f3db1b3260512c42c4ce407faca606976df68c2c3630d96bc50fc4dc2705af0e5932e77e78810cc93cabcb2990901

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5FL4By6.exe

Filesize
219KB

MD5
1e26039fc4c8fef8150f57c09af75c48

SHA1
4119080c2932a7bfa06d50c936523dc571e4a200

SHA256
641b003e3fa92e55ad5c9788d52211a11c8aa8577b7de433e5c3f18631c288e1

SHA512
5cd691395f150bf9d820a616105395f6d96f3db1b3260512c42c4ce407faca606976df68c2c3630d96bc50fc4dc2705af0e5932e77e78810cc93cabcb2990901

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CO2Sf32.exe

Filesize
1.2MB

MD5
68c5b551447db44abd137351b601bea7

SHA1
ad4c59708806d03e364ee6746b7443652d2f45ed

SHA256
b1b5a7dba1c11a81f7c23b979b09faadcc0e667961249db9092845ddaef42286

SHA512
a5ac2e9762c5c3247b18d714b92e23e3edc84fdfcb0af4e0e34af43968615f9e8129aaa67221cf76fda29e6048d9218c2b68c9d20d10a72d902436c25b48b807

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CO2Sf32.exe

Filesize
1.2MB

MD5
68c5b551447db44abd137351b601bea7

SHA1
ad4c59708806d03e364ee6746b7443652d2f45ed

SHA256
b1b5a7dba1c11a81f7c23b979b09faadcc0e667961249db9092845ddaef42286

SHA512
a5ac2e9762c5c3247b18d714b92e23e3edc84fdfcb0af4e0e34af43968615f9e8129aaa67221cf76fda29e6048d9218c2b68c9d20d10a72d902436c25b48b807

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ea1TY8js.exe

Filesize
1.4MB

MD5
2b53740644a54410d5b19efe5e77f6c0

SHA1
cb5816ad004863c99111ba11ac7a444cc3ec9cba

SHA256
f2e3d2660adc3088eab0bd3667f7a3d33f8d0078a8eff7ca079edb6bc8ad2447

SHA512
e885589d84cc6a1291eb00dda9b21c359b6defeb32019b94bdc32b106d203e2c2e9bc102ac6fc5cf755572514313cdbc598cea47a8fa08a830ce5381531535d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ea1TY8js.exe

Filesize
1.4MB

MD5
2b53740644a54410d5b19efe5e77f6c0

SHA1
cb5816ad004863c99111ba11ac7a444cc3ec9cba

SHA256
f2e3d2660adc3088eab0bd3667f7a3d33f8d0078a8eff7ca079edb6bc8ad2447

SHA512
e885589d84cc6a1291eb00dda9b21c359b6defeb32019b94bdc32b106d203e2c2e9bc102ac6fc5cf755572514313cdbc598cea47a8fa08a830ce5381531535d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Pf260EL.exe

Filesize
1.9MB

MD5
f6a960e73b56f4fa26437ac5e12d7773

SHA1
96b2c9aa721bdd672501e5b07d12f61b6db86886

SHA256
68285c53ce6f94bd947ead934a14efca01ae117452fe559954e943748713f93c

SHA512
f8f13dbc76b5a2c3736a350ed2a973e7ba47ec20e2de6bd509ac8f67916e44b34fe06aee7973b2387e190277c8d4a479dabf833618eeecdd290ff4db46b6d3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4Pf260EL.exe

Filesize
1.9MB

MD5
f6a960e73b56f4fa26437ac5e12d7773

SHA1
96b2c9aa721bdd672501e5b07d12f61b6db86886

SHA256
68285c53ce6f94bd947ead934a14efca01ae117452fe559954e943748713f93c

SHA512
f8f13dbc76b5a2c3736a350ed2a973e7ba47ec20e2de6bd509ac8f67916e44b34fe06aee7973b2387e190277c8d4a479dabf833618eeecdd290ff4db46b6d3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UE8nB31.exe

Filesize
698KB

MD5
100ef056fd8f78622c43bec947a4c52e

SHA1
e90d98c4a460ebb1a8d3d79b366b0d7e75edd29e

SHA256
aeaa828a314357ec9eadb2d7c1fcfd4a4d188c9756e939d030bbfaac653e06a7

SHA512
4e321b70b215faca7fd60dce0441c7bb4ade5f01fc67cd9d1560a04bf3e443d47e539b4432117300147c507b2766a8ade12175f95d34e6942fa898740ec11c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UE8nB31.exe

Filesize
698KB

MD5
100ef056fd8f78622c43bec947a4c52e

SHA1
e90d98c4a460ebb1a8d3d79b366b0d7e75edd29e

SHA256
aeaa828a314357ec9eadb2d7c1fcfd4a4d188c9756e939d030bbfaac653e06a7

SHA512
4e321b70b215faca7fd60dce0441c7bb4ade5f01fc67cd9d1560a04bf3e443d47e539b4432117300147c507b2766a8ade12175f95d34e6942fa898740ec11c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3PV81jF.exe

Filesize
30KB

MD5
7cd0e98ae135f3d2c44e0a815e32f85b

SHA1
ee86542e0cad0991ea254ac1642b76f255b62988

SHA256
3fef3e99fb8f94bac52737b4137a549bb45c738febb78b47852588e868107760

SHA512
c24fbc70dccc52b86920c0cc61ee0e993c7b43019dfefc9c80462195ee1b2b592afdba1ed5f8e968f03f967bdc551062e6afc8c62217a50d93eec714e59da29b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3PV81jF.exe

Filesize
30KB

MD5
7cd0e98ae135f3d2c44e0a815e32f85b

SHA1
ee86542e0cad0991ea254ac1642b76f255b62988

SHA256
3fef3e99fb8f94bac52737b4137a549bb45c738febb78b47852588e868107760

SHA512
c24fbc70dccc52b86920c0cc61ee0e993c7b43019dfefc9c80462195ee1b2b592afdba1ed5f8e968f03f967bdc551062e6afc8c62217a50d93eec714e59da29b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4ud267Yr.exe

Filesize
1.9MB

MD5
f6a960e73b56f4fa26437ac5e12d7773

SHA1
96b2c9aa721bdd672501e5b07d12f61b6db86886

SHA256
68285c53ce6f94bd947ead934a14efca01ae117452fe559954e943748713f93c

SHA512
f8f13dbc76b5a2c3736a350ed2a973e7ba47ec20e2de6bd509ac8f67916e44b34fe06aee7973b2387e190277c8d4a479dabf833618eeecdd290ff4db46b6d3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WZ7WR7iX.exe

Filesize
871KB

MD5
f7372bf634eec5418fb70eaef4e12278

SHA1
3dab65fac0392438c946b6750c9e680e87235f77

SHA256
60baff3ee79668de84ecf39b716bca704fe1dfe9e123316d205d426d5f2cbf1b

SHA512
90d0ebf67317181f4141b2a15bb89ee9a9a23392393aec786324c967b6ea4b9d0b3032c6fc57f8bea76e16af171e976216483c1e1506f8d40055af8e59b38769

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WZ7WR7iX.exe

Filesize
871KB

MD5
f7372bf634eec5418fb70eaef4e12278

SHA1
3dab65fac0392438c946b6750c9e680e87235f77

SHA256
60baff3ee79668de84ecf39b716bca704fe1dfe9e123316d205d426d5f2cbf1b

SHA512
90d0ebf67317181f4141b2a15bb89ee9a9a23392393aec786324c967b6ea4b9d0b3032c6fc57f8bea76e16af171e976216483c1e1506f8d40055af8e59b38769

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vt0BW41.exe

Filesize
574KB

MD5
7c6049b16181cd6204c44665c7235b13

SHA1
3a141589bedb1d124243d4af245299fe8351c7ab

SHA256
f56b718b3b00c728dd7a9578d1cfd3cc4240fb5062f3d23f261f3c3d5cdfc1da

SHA512
b76cbf2d9cc821478aa159f8e3b9681a6fb687af7a6be5d29274efa8a0997f2b7227a8515b04e0370ec33f4eaebacbeb5358b84fa049124c38a3729a8d846e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vt0BW41.exe

Filesize
574KB

MD5
7c6049b16181cd6204c44665c7235b13

SHA1
3a141589bedb1d124243d4af245299fe8351c7ab

SHA256
f56b718b3b00c728dd7a9578d1cfd3cc4240fb5062f3d23f261f3c3d5cdfc1da

SHA512
b76cbf2d9cc821478aa159f8e3b9681a6fb687af7a6be5d29274efa8a0997f2b7227a8515b04e0370ec33f4eaebacbeb5358b84fa049124c38a3729a8d846e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kg42xs0.exe

Filesize
1.6MB

MD5
29e9546e7fe835b413a5d65599213b53

SHA1
64d6d2eca4e197a390702a08b074c5ef6da2fa32

SHA256
d65b10dc2c1598935786fd0d562aaee9c9fc6b7d6f950da6de13db6686cab814

SHA512
e556877abd79052f3d3bc6175971001531f363745d396aa96302218cf11b4fc94980f946aae758ff14d8cc8af4d9dcb26503142e2d1cded2d21ab37ddc009658

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kg42xs0.exe

Filesize
1.6MB

MD5
29e9546e7fe835b413a5d65599213b53

SHA1
64d6d2eca4e197a390702a08b074c5ef6da2fa32

SHA256
d65b10dc2c1598935786fd0d562aaee9c9fc6b7d6f950da6de13db6686cab814

SHA512
e556877abd79052f3d3bc6175971001531f363745d396aa96302218cf11b4fc94980f946aae758ff14d8cc8af4d9dcb26503142e2d1cded2d21ab37ddc009658

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Iz1253.exe

Filesize
180KB

MD5
a7bdf0a0de83536f0fa0dd135915bf13

SHA1
68be64468306da0b664f36ffaf902921a997746f

SHA256
e267258288041a9da1adc8ef3f6d551d1ba8ba5e3f2aa3b2c9627d7a2381404a

SHA512
8aa9f3cc964ce2a37090d19dee05007f2c0a940adbc8081504ac78c0d55c262b9d5bb8925e0c9efd3af758251d1df7ccaa9a89e31c7ab30d37b1a489fb8728e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Iz1253.exe

Filesize
180KB

MD5
a7bdf0a0de83536f0fa0dd135915bf13

SHA1
68be64468306da0b664f36ffaf902921a997746f

SHA256
e267258288041a9da1adc8ef3f6d551d1ba8ba5e3f2aa3b2c9627d7a2381404a

SHA512
8aa9f3cc964ce2a37090d19dee05007f2c0a940adbc8081504ac78c0d55c262b9d5bb8925e0c9efd3af758251d1df7ccaa9a89e31c7ab30d37b1a489fb8728e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ie6Kf5fU.exe

Filesize
675KB

MD5
b283ef8e6a1850b0df914dc5c3ee4857

SHA1
faf4cafe1de5697d8b46897e7608698d71bd3748

SHA256
2eb46c0a7d712fb1acfdea7b89bdd04ff05f9a5a031332553b5930b3b7068e65

SHA512
2c122f472f052c473686fbc3c03f88728cab48ae63587fbcef288970fb898ef81f6e9ef0b12ea72f91fed093a0dac3661aa2159ffc7baa56a6691bac27bf8713

Download Submit
C:\Users\Admin\AppData\Local\Temp\K.exe

Filesize
8KB

MD5
ac65407254780025e8a71da7b925c4f3

SHA1
5c7ae625586c1c00ec9d35caa4f71b020425a6ba

SHA256
26cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e

SHA512
27d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
1e26039fc4c8fef8150f57c09af75c48

SHA1
4119080c2932a7bfa06d50c936523dc571e4a200

SHA256
641b003e3fa92e55ad5c9788d52211a11c8aa8577b7de433e5c3f18631c288e1

SHA512
5cd691395f150bf9d820a616105395f6d96f3db1b3260512c42c4ce407faca606976df68c2c3630d96bc50fc4dc2705af0e5932e77e78810cc93cabcb2990901

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
1e26039fc4c8fef8150f57c09af75c48

SHA1
4119080c2932a7bfa06d50c936523dc571e4a200

SHA256
641b003e3fa92e55ad5c9788d52211a11c8aa8577b7de433e5c3f18631c288e1

SHA512
5cd691395f150bf9d820a616105395f6d96f3db1b3260512c42c4ce407faca606976df68c2c3630d96bc50fc4dc2705af0e5932e77e78810cc93cabcb2990901

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
1e26039fc4c8fef8150f57c09af75c48

SHA1
4119080c2932a7bfa06d50c936523dc571e4a200

SHA256
641b003e3fa92e55ad5c9788d52211a11c8aa8577b7de433e5c3f18631c288e1

SHA512
5cd691395f150bf9d820a616105395f6d96f3db1b3260512c42c4ce407faca606976df68c2c3630d96bc50fc4dc2705af0e5932e77e78810cc93cabcb2990901

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos2.exe

Filesize
1.5MB

MD5
665db9794d6e6e7052e7c469f48de771

SHA1
ed9a3f9262f675a03a9f1f70856e3532b095c89f

SHA256
c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196

SHA512
69585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.4MB

MD5
b36c2f7919fc727aad73b8288825787a

SHA1
56e23f0772c0108acba485c62e5d51d2765be101

SHA256
ec953c0cc3b6e832e7df74a5dad97e52c67b2b7bff97487f0f624df569009d16

SHA512
fb9e2fa60840ca6458b87e370897d67f38dab9d2283766f366d6996e867ae4ff46e135dce246768e40a8860014952e6c182830b83e0767aa580425a2bcf507f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.5MB

MD5
b224196c88f09b615527b2df0e860e49

SHA1
f9ae161836a34264458d8c0b2a083c98093f1dec

SHA256
2a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8

SHA512
d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
260KB

MD5
f39a0110a564f4a1c6b96c03982906ec

SHA1
08e66c93b575c9ac0a18f06741dabcabc88a358b

SHA256
f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

SHA512
c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

Download Submit
memory/2836-232-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/2836-62-0x0000000007280000-0x0000000007824000-memory.dmp

Filesize
5.6MB

Download
memory/2836-61-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/2836-54-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2836-255-0x0000000006F00000-0x0000000006F10000-memory.dmp

Filesize
64KB

Download
memory/2836-63-0x0000000006DB0000-0x0000000006E42000-memory.dmp

Filesize
584KB

Download
memory/2836-75-0x0000000006EB0000-0x0000000006EBA000-memory.dmp

Filesize
40KB

Download
memory/2836-69-0x0000000006F00000-0x0000000006F10000-memory.dmp

Filesize
64KB

Download
memory/2836-77-0x0000000007E50000-0x0000000008468000-memory.dmp

Filesize
6.1MB

Download
memory/2836-82-0x00000000070B0000-0x00000000070FC000-memory.dmp

Filesize
304KB

Download
memory/2836-78-0x0000000007830000-0x000000000793A000-memory.dmp

Filesize
1.0MB

Download
memory/2836-81-0x0000000007110000-0x000000000714C000-memory.dmp

Filesize
240KB

Download
memory/2836-79-0x0000000007080000-0x0000000007092000-memory.dmp

Filesize
72KB

Download
memory/3232-44-0x0000000002880000-0x0000000002896000-memory.dmp

Filesize
88KB

Download
memory/3356-360-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3356-361-0x00000000020C0000-0x000000000211A000-memory.dmp

Filesize
360KB

Download
memory/3356-365-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/3356-392-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/3356-391-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3596-624-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/3768-45-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3768-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4060-353-0x0000000000FF0000-0x0000000000FFA000-memory.dmp

Filesize
40KB

Download
memory/4060-356-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/4060-401-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/4060-456-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/4172-357-0x00000000070D0000-0x00000000070E0000-memory.dmp

Filesize
64KB

Download
memory/4172-346-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/4172-400-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/4172-444-0x00000000070D0000-0x00000000070E0000-memory.dmp

Filesize
64KB

Download
memory/4920-371-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4920-381-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4920-380-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4920-384-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5060-51-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5060-53-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5060-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5060-39-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5068-561-0x00000000074E0000-0x00000000074F0000-memory.dmp

Filesize
64KB

Download
memory/5068-389-0x00000000074E0000-0x00000000074F0000-memory.dmp

Filesize
64KB

Download
memory/5068-535-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5068-385-0x0000000000590000-0x00000000005CE000-memory.dmp

Filesize
248KB

Download
memory/5068-386-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5432-660-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/5432-659-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/5432-664-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/5456-663-0x0000000000C20000-0x0000000000C7A000-memory.dmp

Filesize
360KB

Download
memory/5456-665-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5536-539-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5536-582-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5536-538-0x0000000000620000-0x00000000011A4000-memory.dmp

Filesize
11.5MB

Download
memory/5552-666-0x000000006C200000-0x000000006C32D000-memory.dmp

Filesize
1.2MB

Download
memory/5688-637-0x00000000007D0000-0x00000000008D0000-memory.dmp

Filesize
1024KB

Download
memory/5688-648-0x00000000022E0000-0x00000000022E9000-memory.dmp

Filesize
36KB

Download
memory/5748-667-0x0000000002F00000-0x00000000037EB000-memory.dmp

Filesize
8.9MB

Download
memory/5820-608-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5820-576-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/5820-572-0x0000000000280000-0x00000000003FE000-memory.dmp

Filesize
1.5MB

Download
memory/6008-627-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/6008-628-0x0000000000550000-0x00000000005AA000-memory.dmp

Filesize
360KB

Download
memory/6008-657-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/6028-602-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/6112-612-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/6112-611-0x00007FF89BD20000-0x00007FF89C7E1000-memory.dmp

Filesize
10.8MB

Download
memory/6112-607-0x0000000000F50000-0x0000000000F58000-memory.dmp

Filesize
32KB

Download