5f72efa758d857722a10e5e90313fc236d3e60342a59cd9bb7f35779e91be461

Resubmissions

22-02-2024 15:00

240222-sdrylsbh25 10

Analysis

max time kernel
114s
max time network
115s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
22-02-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Virus/VineMEMZ-Original.exe
Size

39.6MB
MD5

c4a04acc0b0133787d58d91338b35556
SHA1

308d43a455d578e7305293ff01174ba39884a1f1
SHA256

e0e50205f43a14048bf22c8442fa55a0467b828529e78a4927a6b39a35c6a947
SHA512

2f81114158c1deaffb2a79462d1f8d32fad6ed8e4a6ad0a7d7aa243a6ef06e90c3f0b88325fb70f27f7d02cbdd1d6d6281b9373f0c813fb981757cfd3b7ef767
SSDEEP

786432:1QQ+DLvsiBiFOMCdQCKiK/yRtlO1kXxFkA0mRoe653PDlTmJ46qShdKG543yMF:GQcv6NKpbtllXxKLmee653PRqDrKG5u5

Score

8^/10

bootkit persistence ransomware

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MEMZ.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "rekt.exe"	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rekt.exe"	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "rekt.exe"	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	MEMZ.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

MEMZ.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Control Panel\International\Geo\Nation MEMZ.exe
Executes dropped EXE 5 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid process

4900 MEMZ.exe
3820 MEMZ.exe
3016 MEMZ.exe
2904 MEMZ.exe
2840 MEMZ.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Control Panel\International\Geo\Nation	MEMZ.exe

pid	process
4900	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
2904	MEMZ.exe
2840	MEMZ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

MEMZ.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Data\\Pussy.png"	MEMZ.exe

Drops file in Windows directory 11 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4abd4b60a065da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 8bf8025ba065da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = a03f6b69a065da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8789a956a065da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 607b7368ea81da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exe

pid	process
3016	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
3820	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
3820	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
3820	MEMZ.exe
2904	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
3820	MEMZ.exe
3016	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
2904	MEMZ.exe
3016	MEMZ.exe
2904	MEMZ.exe
3016	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MEMZ.exe

pid process

2840 MEMZ.exe

pid	process
2840	MEMZ.exe

Suspicious behavior: MapViewOfSection 24 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AUDIODG.EXEMicrosoftEdgeCP.exe

description	pid	process
Token: 33	3284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3284	AUDIODG.EXE
Token: SeDebugPrivilege	2952	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2952	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2952	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2952	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MEMZ.exe

pid process

2840 MEMZ.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

MEMZ.exe

pid process

2840 MEMZ.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

5012 MicrosoftEdge.exe
3148 MicrosoftEdgeCP.exe
2952 MicrosoftEdgeCP.exe
3148 MicrosoftEdgeCP.exe
5560 MicrosoftEdgeCP.exe

pid	process
2840	MEMZ.exe

pid	process
2840	MEMZ.exe

pid	process
5012	MicrosoftEdge.exe
3148	MicrosoftEdgeCP.exe
2952	MicrosoftEdgeCP.exe
3148	MicrosoftEdgeCP.exe
5560	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VineMEMZ-Original.exeMEMZ.exeMEMZ.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 2116 wrote to memory of 4900	2116	VineMEMZ-Original.exe	MEMZ.exe
PID 2116 wrote to memory of 4900	2116	VineMEMZ-Original.exe	MEMZ.exe
PID 2116 wrote to memory of 4900	2116	VineMEMZ-Original.exe	MEMZ.exe
PID 4900 wrote to memory of 2904	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 2904	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 2904	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 3820	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 3820	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 3820	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 3016	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 3016	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 3016	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 2840	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 2840	4900	MEMZ.exe	MEMZ.exe
PID 4900 wrote to memory of 2840	4900	MEMZ.exe	MEMZ.exe
PID 2840 wrote to memory of 4528	2840	MEMZ.exe	notepad.exe
PID 2840 wrote to memory of 4528	2840	MEMZ.exe	notepad.exe
PID 2840 wrote to memory of 4528	2840	MEMZ.exe	notepad.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3880	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 1620	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3076	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3076	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 3076	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4772	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4772	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4772	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4652	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4652	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4652	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4652	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4652	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4652	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4336	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4336	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3148 wrote to memory of 4336	3148	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\Virus\VineMEMZ-Original.exe
"C:\Users\Admin\AppData\Local\Temp\Virus\VineMEMZ-Original.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
/watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2904

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
/watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3820

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
/watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3016

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
/main
3⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
4⤵
PID:4528

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5012

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4652

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZP3JQEV6\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\styles__ltr[1].css

Filesize
55KB

MD5
eb4bc511f79f7a1573b45f5775b3a99b

SHA1
d910fb51ad7316aa54f055079374574698e74b35

SHA256
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

SHA512
ec9bdf1c91b6262b183fd23f640eac22016d1f42db631380676ed34b962e01badda91f9cbdfa189b42fe3182a992f1b95a7353af41e41b2d6e1dab17e87637a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\recaptcha__en[1].js

Filesize
491KB

MD5
3e528c5bd4e8985f914f84bc5f86df5f

SHA1
34104ea645a6789dd9cb58c264e20ed6855ea1de

SHA256
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6

SHA512
c59a1d40f649446f33ff0ff3fa9a8e997d3cff10f968d35226ba08bb91c9013ae937460cf2dab0888848abe1b693d4377fbd6904e3e03360b15035a8c3e9bc97

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\1QT6VULZ\yahoo[1].png

Filesize
1KB

MD5
b6814ae5582d7953821acbd76e977bb4

SHA1
75a33fc706c2c6ba233e76c17337e466949f403c

SHA256
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

SHA512
958268f22e72875b97c42d8927e6a1d6168c94fe2184de906029688a9d63038301df2e3de57e571a3d0ecc7ad41178401823e5c54576936d37c84c7a3ed8ef6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BSV2JZC9\favicon-trans-bg-blue-mg[1].ico

Filesize
4KB

MD5
30967b1b52cb6df18a8af8fcc04f83c9

SHA1
aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588

SHA256
439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e

SHA512
7cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\QJ11IDKU\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\KFOlCnqEu92Fr1MmEU9fCxc4EsA[1].woff2

Filesize
5KB

MD5
6bef514048228359f2f8f5e0235f8599

SHA1
318cb182661d72332dc8a8316d2e6df0332756c4

SHA256
135d563a494b1f8e6196278b7f597258a563f1438f5953c6fbef106070f66ec8

SHA512
23fb4605a90c7616117fab85fcd88c23b35d22177d441d01ce6270a9e95061121e0f7783db275ad7b020feaba02bbbc0f77803ca9fb843df6f1b2b7377288773

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\KFOmCnqEu92Fr1Mu4mxK[1].woff2

Filesize
14KB

MD5
5d4aeb4e5f5ef754e307d7ffaef688bd

SHA1
06db651cdf354c64a7383ea9c77024ef4fb4cef8

SHA256
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

SHA512
7eb7c301df79d35a6a521fae9d3dccc0a695d3480b4d34c7d262dd0c67abec8437ed40e2920625e98aaeafba1d908dec69c3b07494ec7c29307de49e91c2ef48

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\KFOmCnqEu92Fr1Mu72xKOzY[1].woff2

Filesize
15KB

MD5
e3836d1191745d29137bfe16e4e4a2c2

SHA1
4dc8845d97df9cb627d9e6fdd49be1ef9eb9a69c

SHA256
98eec6c6fa4dcd4825e48eff334451979afc23cd085aea2d45b04dc1259079dd

SHA512
9e9ec420cf75bf47a21e59a822e01dc89dcf97eec3cc117c54ce51923c9a6f2c462355db1bc20cdf665ef4a5b40ffcfa9c8cee05bb5e112c380038bfef29c397

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\desktop_polymer[1].js

Filesize
5.6MB

MD5
8d22b1ab4fdce1597787528e8aec3e3e

SHA1
4b48b0016a8af65c9774df2f3cab7421f90c684f

SHA256
9fa039ac94c49e5ac98e437b00258a09c4893d15a30b2133dc8c10fec782f0c3

SHA512
3851cc100f255f39936db8f46f28ea0bf003c08f9a0b02b4b1d67996ef8264c7093c8fa055c057371ed837f552fb7721146ae28991867fc3afa8a20cb73b59af

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\intersection-observer.min[1].js

Filesize
5KB

MD5
936a7c8159737df8dce532f9ea4d38b4

SHA1
8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5

SHA256
3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9

SHA512
54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\www-i18n-constants[1].js

Filesize
5KB

MD5
f3356b556175318cf67ab48f11f2421b

SHA1
ace644324f1ce43e3968401ecf7f6c02ce78f8b7

SHA256
263c24ac72cb26ab60b4b2911da2b45fef9b1fe69bbb7df59191bb4c1e9969cd

SHA512
a2e5b90b1944a9d8096ae767d73db0ec5f12691cf1aebd870ad8e55902ceb81b27a3c099d924c17d3d51f7dbc4c3dd71d1b63eb9d3048e37f71b2f323681b0ad

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\www-onepick[1].css

Filesize
1011B

MD5
5306f13dfcf04955ed3e79ff5a92581e

SHA1
4a8927d91617923f9c9f6bcc1976bf43665cb553

SHA256
6305c2a6825af37f17057fd4dcb3a70790cc90d0d8f51128430883829385f7cc

SHA512
e91ecd1f7e14ff13035dd6e76dfa4fa58af69d98e007e2a0d52bff80d669d33beb5fafefe06254cbc6dd6713b4c7f79c824f641cb704142e031c68eccb3efed3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\438PXETS\www-tampering[1].js

Filesize
10KB

MD5
ce762a9d30d6c70bb0516e8cefc958bf

SHA1
da6cac9c717daa3a39f82f3421782c99edd9329d

SHA256
a9fc343d602527a427e57671d021524a9ff5af7b3df1a58900a3b01057bdd8c7

SHA512
230753fbb26e90438dd43874d02fbbb1ad6db9a0fe76da978ea47a8ca06fc99dd5e475104abb5dd25ce222423d9bda7991fd0ee896386561cd6f9ac10f8932e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\ASXaQ1z0KI3ZfklOIfMB5uxT7QXe_3xy1EhxeYl1sZs[1].js

Filesize
16KB

MD5
4bde1b32d064b00b24eeea516ffa9aa6

SHA1
8982f143c3516f8590fd244c8879b53f67a8b38c

SHA256
0125da435cf4288dd97e494e21f301e6ec53ed05deff7c72d44871798975b19b

SHA512
f25b75b81db219154c337ed01d72ee4196980714a5f8d5a5d8b80f806e0b9dc9e95d105e9c8df3ca5efb5b136c0549a2c02cc7245eb65b180bf328e24a8029f6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmEU9fABc4EsA[1].woff2

Filesize
9KB

MD5
df648143c248d3fe9ef881866e5dea56

SHA1
770cae7a298ecfe5cf5db8fe68205cdf9d535a47

SHA256
6a3f2c2a5db6e4710e44df0db3caec5eb817e53989374e9eac68057d64b7f6d2

SHA512
6ff33a884f4233e092ee11e2ad7ef34d36fb2b61418b18214c28aa8b9bf5b13ceccfa531e7039b4b7585d143ee2460563e3052364a7dc8d70b07b72ec37b0b66

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmEU9fBxc4EsA[1].woff2

Filesize
7KB

MD5
207d2af0a0d9716e1f61cadf347accc5

SHA1
0f64b5a6cc91c575cb77289e6386d8f872a594ca

SHA256
416d72c8cee51c1d6c6a1cab525b2e3b4144f2f457026669ddad34b70dabd485

SHA512
da8b03ee3029126b0c7c001d7ef2a7ff8e6078b2df2ec38973864a9c0fd8deb5ecef021c12a56a24a3fd84f38f4d14ea995df127dc34f0b7eec8e6e3fc8d1bbd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmEU9fCBc4EsA[1].woff2

Filesize
1KB

MD5
52e881a8e8286f6b6a0f98d5f675bb93

SHA1
9c9c4bc1444500b298dfea00d7d2de9ab459a1ad

SHA256
5e5321bb08de884e4ad6585b8233a7477fa590c012e303ea6f0af616a6e93ffb

SHA512
45c07a5e511948c328f327e2ef4c3787ac0173c72c51a7e43e3efd3e47dd332539af15f3972ef1cc023972940f839fffe151aefaa04f499ae1faceaab6f1014f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmEU9fCRc4EsA[1].woff2

Filesize
14KB

MD5
79c7e3f902d990d3b5e74e43feb5f623

SHA1
44aae0f53f6fc0f1730acbfdf4159684911b8626

SHA256
2236e56f735d25696957657f099459d73303b9501cc39bbd059c20849c5bedff

SHA512
3a25882c7f3f90a7aa89ecab74a4be2fddfb304f65627b590340be44807c5c5e3826df63808c7cd06daa3420a94090249321a1e035b1cd223a15010c510518df

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmYUtfBxc4EsA[1].woff2

Filesize
7KB

MD5
585f849571ef8c8f1b9f1630d529b54d

SHA1
162c5b7190f234d5f841e7e578b68779e2bf48c2

SHA256
c6dcdefaa63792f3c29abc520c8a2c0bc6e08686ea0187c9baac3d5d329f7002

SHA512
1140c4b04c70a84f1070c27e8e4a91d02fda4fc890877900c53cfd3a1d8908b677a412757061de43bc71022dfdd14288f9db0852ef6bf4d2c1615cb45628bebc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmYUtfCBc4EsA[1].woff2

Filesize
1KB

MD5
7cbd23921efe855138ad68835f4c5921

SHA1
78a3ae9ec08f2cf8ebb791a2331b33a03ab8cc76

SHA256
8eaae4c8680e993b273145315c76a9a278f696467c426637d4beab8cb3dc4a3d

SHA512
d8a4db91d2063273d31f77728b44557612b85f51143973caa3cfd60ab18f8c3e4b8cdaab43af843fe29441cd1d8299bf2f139a78e47bf740277b33a377377177

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmYUtfCRc4EsA[1].woff2

Filesize
14KB

MD5
e904f1745726f4175e96c936525662a7

SHA1
af4e9ee282fea95be6261fc35b2accaed24f6058

SHA256
65c7b85c92158adb2d71bebe0d6dfb31ab34de5e7d82134fe1aa4eba589fc296

SHA512
7a279d41c8f60806c2253cba5b399be7add861bd15bf0ac4fa7c96fa1eee6557bf1ebd684e909086d9292739f27fa18947af5c98f4920fe00da3acf209c6260a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOlCnqEu92Fr1MmYUtfCxc4EsA[1].woff2

Filesize
4KB

MD5
133b0f334c0eb9dbf32c90e098fab6bd

SHA1
398f8fd3a668ef0b16435b01ad0c6122e3784968

SHA256
6581d0d008bc695e0f6beffbd7d51abb4d063ef5dedc16feb09aa92ea20c5c00

SHA512
2a5a0956ecc8680e4e9ef73ec05bc376a1cc49ddb12ee76316378fe9626dccedb21530e3e031b2dae2830874cc1b6bfd6cce2d6d0dce54587ff0fc3780041ace

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOmCnqEu92Fr1Mu4WxKOzY[1].woff2

Filesize
7KB

MD5
7aa7eb76a9f66f0223c8197752bb6bc5

SHA1
ac56d5def920433c7850ddbbdd99d218d25afd2b

SHA256
9ca415df2c57b1f26947351c66ccfaf99d2f8f01b4b8de019a3ae6f3a9c780c7

SHA512
e9a513741cb90305fbe08cfd9f7416f192291c261a7843876293e04a874ab9b914c3a4d2ed771a9d6484df1c365308c9e4c35cd978b183acf5de6b96ac14480d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOmCnqEu92Fr1Mu5mxKOzY[1].woff2

Filesize
9KB

MD5
efe937997e08e15b056a3643e2734636

SHA1
d02decbf472a0928b054cc8e4b13684539a913db

SHA256
53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361

SHA512
721c903e06f00840140ed5eec06329221a2731efc483e025043675b1f070b03a544f8eb153b63cd981494379a9e975f014b57c286596b6f988cee1aaf04a8c65

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOmCnqEu92Fr1Mu7GxKOzY[1].woff2

Filesize
11KB

MD5
15d8ede0a816bc7a9838207747c6620c

SHA1
f6e2e75f1277c66e282553ae6a22661e51f472b8

SHA256
dbb8f45730d91bffff8307cfdf7c82e67745d84cb6063a1f3880fadfad59c57d

SHA512
39c75f8e0939275a69f8d30e7f91d7ca06af19240567fb50e441a0d2594b73b6a390d11033afb63d68c86c89f4e4bf39b3aca131b30f640d21101dc414e42c97

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOmCnqEu92Fr1Mu7WxKOzY[1].woff2

Filesize
5KB

MD5
a835084624425dacc5e188c6973c1594

SHA1
1bef196929bffcabdc834c0deefda104eb7a3318

SHA256
0dfa6a82824cf2be6bb8543de6ef56b87daae5dd63f9e68c88f02697f94af740

SHA512
38f2764c76a545349e8096d4608000d9412c87cc0cb659cf0cf7d15a82333dd339025a4353b9bd8590014502abceb32ca712108a522ca60cbf1940d4e4f6b98a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KY3QU39N\KFOmCnqEu92Fr1Mu7mxKOzY[1].woff2

Filesize
1KB

MD5
57993e705ff6f15e722f5f90de8836f8

SHA1
3fecc33bac640b63272c9a8dffd3df12f996730b

SHA256
836f58544471e0fb0699cb9ddd0fd0138877733a98b4e029fca1c996d4fb038d

SHA512
31f92fb495a1a20ab5131493ab8a74449aabf5221e2901915f2cc917a0878bb5a3cbc29ab12324ffe2f0bc7562a142158268c3f07c7dca3e02a22a9ade41721e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\KFOlCnqEu92Fr1MmEU9fChc4EsA[1].woff2

Filesize
11KB

MD5
16aedbf057fbb3da342211de2d071f11

SHA1
fdee07631b40b264208caa8714faaa5b991d987b

SHA256
7566a2f09ff8534334b7a44f72a1afaba6bdbb782209be8804636ee8b963c75f

SHA512
5cd45dfb0d0ee44afd9b3ffd93c2942c2f04e359d067d4631edd67a2ee09149766294b29c75aaab7436dacc775a8ca02392c5e4cfb8d7fede19c028448507e0e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\KFOlCnqEu92Fr1MmYUtfBBc4[1].woff2

Filesize
14KB

MD5
19b7a0adfdd4f808b53af7e2ce2ad4e5

SHA1
81d5d4c7b5035ad10cce63cf7100295e0c51fdda

SHA256
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd

SHA512
49da16000687ac81fc4ca9e9112bdca850bb9f32e0af2fe751abc57a8e9c3382451b50998ceb9de56fc4196f1dc7ef46bba47933fc47eb4538124870b7630036

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\KFOlCnqEu92Fr1MmYUtfChc4EsA[1].woff2

Filesize
11KB

MD5
29542ac824c94a70cb8abdeef41cd871

SHA1
df5010dad18d6c8c0ad66f6ff317729d2c0090ba

SHA256
63ef838f895e018722b60f6e7e1d196ff3d90014c70465703fc58e708e83af64

SHA512
52f91e02b82f9f27d334704b62a78e746c80023ee8882b96cb24cb4043f9a256f395d24830b1f4513bd7597f8c564af20db9c715ab014eb2ab752fd697156591

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\api[1].js

Filesize
850B

MD5
8631a151ef23de877d89a889add9f7ce

SHA1
261282f887bfdade4832899b35481d67e5242326

SHA256
408791ea3484d7ccc3a26ccbfd9a66966a9b17be998b58db233933966c40d7c6

SHA512
16e14a64e853d800fa3603d2d585970e72e35f01b8e4d5ee077f0510e1b8c929d909a868c6bf226defd8d5023c8b305d3265becea66a0660a522658aa717d84d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\logo_48[1].png

Filesize
2KB

MD5
ef9941290c50cd3866e2ba6b793f010d

SHA1
4736508c795667dcea21f8d864233031223b7832

SHA256
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

SHA512
a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\rs=AGKMywFj2aqErjQg53MufwUQt-SoEextdQ[1].css

Filesize
2.6MB

MD5
8adb233e751424e4965023c082fab251

SHA1
a7edf175c7bbfcad8dc98b1aec39f83a06c8280f

SHA256
05df0868be3ffde8d26512bbad0c0594a6d41d530bd893436cbdc09f48b7f754

SHA512
987d366e17b3aac51f9c5e1a9f511715fbec533ecb8604e338bfc9ea05a939db9de03eea839706f105f179122c06c7ffcc4a11e40194d1e568ff6809696780e3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\scheduler[1].js

Filesize
9KB

MD5
dac3d45d4ce59d457459a8dbfcd30232

SHA1
946dd6b08eb3cf2d063410f9ef2636d648ddb747

SHA256
58ae013b8e95b7667124263f632b49a10acf7da2889547f2d9e4b279708a29f0

SHA512
4f190ce27669725dac9cf944eafed150e16b5f9c1e16a0bbf715de67b9b5a44369c4835da36e37b2786aaf38103fdc1f7de3f60d0dc50163f2528d514ebe2243

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QYLWM32L\webcomponents-ce-sd[1].js

Filesize
95KB

MD5
c1d7b8b36bf9bd97dcb514a4212c8ea5

SHA1
e3957af856710e15404788a87c98fdbb85d3e52e

SHA256
2fed236a295c611b4be5b9bc8608978e148c893e0c51944486982583b210668a

SHA512
0d44065c534313572d90232eb3f88eb308590304c879e38a09d6f2891f92385dc7495aabd776433f7d493d004001b714c7f89855aa6f6bec61c77d50e3a4b8e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\KFOlCnqEu92Fr1MmEU9fBBc4[1].woff2

Filesize
15KB

MD5
285467176f7fe6bb6a9c6873b3dad2cc

SHA1
ea04e4ff5142ddd69307c183def721a160e0a64e

SHA256
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

SHA512
5f9bb763406ea8ce978ec675bd51a0263e9547021ea71188dbd62f0212eb00c1421b750d3b94550b50425bebff5f881c41299f6a33bbfa12fb1ff18c12bc7ff1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\KFOlCnqEu92Fr1MmYUtfABc4EsA[1].woff2

Filesize
9KB

MD5
797d1a46df56bba1126441693c5c948a

SHA1
01f372fe98b4c2b241080a279d418a3a6364416d

SHA256
c451e5cf6b04913a0bc169e20eace7dec760ba1db38cdcc343d8673bb221dd00

SHA512
99827a3fab634b2598736e338213e1041ef26108a1607be294325d90a6ba251a947fd06d8cb0a2104b26d7fe9455feb9088a79fe515be1896c994c5850705edc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\css2[1].css

Filesize
2KB

MD5
31aac18e149a751facc1eab7954dfb7b

SHA1
36d367dcc77416a166aecabb5f6fb5c6c29f3632

SHA256
42706c41583de3f0028f16bad17197dde81807d148ba848ea3924aff4bb8b532

SHA512
df83002d751e6e73377b15966fa5ffacc7f6e2318821c691209fac9b6991d1113b385ca1fbf21e02455a5e5702d4247716c6d03d1938506e6ca740cdeffce351

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\network[1].js

Filesize
14KB

MD5
fdc9b5a35cd74fff3ea372b1a0027a72

SHA1
f1e0e8e7924716986e31bf52b3fca9fb0b781638

SHA256
987eb7deb2211f6bcb391972114e1c5ee71799b5086f53f1125883f18dcf6cbf

SHA512
f19535f91de11cab1ae3d6aced695a372f23d96941a58be0cb68f64c8ae901928158bcfc812f21a1f3d7e3ca1fe8892e24a4ad3f4f1a5afaba6a0555b145e7ce

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\spf[1].js

Filesize
38KB

MD5
eb4fbc0e01eb4a539a6bc202afd4c644

SHA1
1798b96f94e4461c211a1e5118994f6e0dfd53be

SHA256
acae96aa93e083c150d041e2f01185932e5aacd71e4b433cd165dd41aa97103a

SHA512
b608780ed207a42dbe9deee88400a6d9462029a653cec42323490b7023f210e99fb38be5574a451f069eeb5a7f8125505989b331a2243c56d1f2c84a74a2b371

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\web-animations-next-lite.min[1].js

Filesize
49KB

MD5
44ca3d8fd5ff91ed90d1a2ab099ef91e

SHA1
79b76340ca0781fd98aa5b8fdca9496665810195

SHA256
c12e3ac9660ae5de2d775a8c52e22610fff7a651fa069cfa8f64675a7b0a6415

SHA512
a5ce9d846fb4c43a078d364974b22c18a504cdbf2da3d36c689d450a5dc7d0be156a29e11df301ff7e187b831e14a6e5b037aad22f00c03280ee1ad1e829dac8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XO2EDXX0\webworker[1].js

Filesize
102B

MD5
7e005bc0107fe8dd6255d4253228ef02

SHA1
718501672a9b00affe1d688d7b3f2f6202e3e96e

SHA256
80663b7d03f283b27d8d833ca725a43d5cd3d5b5a7dd6487970dca9469f9c139

SHA512
3f17b8ccef75b49e01343a33d14744d589c87ec2a574b529e7ec65ed921c47d6d4a6f768ca4229b4a0b9e87d6624d76e0b4241ad214014305a9aa8e766433156

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\4MM83QNA\www.google[1].xml

Filesize
99B

MD5
382a26435b6bdc8ccc3519ef1a54467c

SHA1
0784f15bc173d22ec1fade3f6e5a51dfa912d0eb

SHA256
f917bac7ce585ed07b68adffe7af5a22185cd5b8403d56ec8e9e71d03bdb150c

SHA512
ea27676da79196fb2aa89204195bcff325743b320217ce686ae5bdd96fe80b3d86e0b7eedb0571166b01e69b692bc3f2444a3c567c2678b62c350e3a3597544e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
04e1c0fb7c50efaf86ba32ac99af0cd4

SHA1
844aeeaba2b3c0a23a3f3580ee9eafde8eee9aa0

SHA256
59cd12f0b76ce31550e9068fed1da5c917f8b4361ef4f3c62c9522473162705a

SHA512
3394f7025fe90250bc8ae1caeba12ec23019a31c1762e5ab757cd874ff33160b1596be9bb079b5641b7476c306c8ebd520fab5f00a0dca06372c67387f21ce40

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_77B1CCFAF3D0516ED1D1368847DAC1ED

Filesize
472B

MD5
ad7c6b5c4aaf1e356d222af358544e4c

SHA1
d556a811ed135d9af2369a2536ea139b7433fb65

SHA256
4b9e087a2b7ed20efcc6b45fae2c57254cde0c90ba871255cfb24ed20ae3499f

SHA512
6f7250dae27d2b4c66e288e1f4ec93bf1ccdb178c5f4542343c43ad7d50291a0aff2a2b50d457335a5582a369c5eb1f7939bd13900ba5b78a88414fd478a0b8e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_FA6E4B522C9C404D38E1A6F1BB26EC85

Filesize
472B

MD5
2b1f595630453c48bc1779fd375750e3

SHA1
2c45ab44bb483b1ed85289348f58d5b57b4c970f

SHA256
5bb14ddefa2282db03690caa802c30d7c465e2c4146dc00a741d5cff6a3ea0d4

SHA512
429d28918f2369c40859de4c2c0c79a64dbedd2e2308e60e57715cd01c5fef3da989724d7ab2db9e62f73bbb68d8dc6d085c118113ab3d0da478be5fdaaceeba

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_FFB46CECE484AA2EE6ADD02001DDCE14

Filesize
472B

MD5
cc2db6658912fbd5d250f28e06aecee5

SHA1
178dc17e6cc4e118b65d50c8db54f94d53276067

SHA256
5aa2b40daacefda96646dd7113248910d03640de7c888b785bf1137561879671

SHA512
76826bb941c8be33a07afb927ae310dd52b9f9e5d5a72ca4e7a6c3771d026a077adad3515ca54001af9b27f43b09f1b591ab61f53e8a7e5797927e58f36c304a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9ced58a6706a6fbd555d372de5cb9474

SHA1
16aaeb77db219f199be90a82c1fae036c6779603

SHA256
2bed4805e750878305fc4a4d28474a82876285ba85fb9a197505766782ab4ce2

SHA512
29c45e11720f2c547c517a19f8b30e50fd3da4b668a8faeaab0147e2405e8663f6bd803c59c8a5f4db18663311bfa79e2a4cc72ff1fe11c539abafeb65141366

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
eec4410ef32496e9103960aa944508d3

SHA1
74d0ee30584664cde25ea6f1d66355565e7bfdfd

SHA256
ef570819ec14d809db563c1e21b95269103ebbf11021c013bed859a559ab28fa

SHA512
83301ed41d68db605ce38356965e37990c9157f8c63034d6bc04140e7670b86cb0dd5cf9ffdf583e3fffd51eefc5c6ad2d73100841468b0f0197bbb458e147a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_77B1CCFAF3D0516ED1D1368847DAC1ED

Filesize
406B

MD5
8d2aa0846e41caa26c0ebdcaaeb8005c

SHA1
c90a294eb03d1fedac08b3bdbad9f584577f90d7

SHA256
b892d0be5376580c4b37974e47b52f0123185642d75b8e4a51068c65dc02d3f5

SHA512
305334b09ffaf34be2bb0119a84783067acfb42d70e9bcc4bf7af72776fb458dd0b12e2837163b98dbfc276fddc9daf59e0bea4d0aabf49e9b9eddc194613196

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_FA6E4B522C9C404D38E1A6F1BB26EC85

Filesize
402B

MD5
1b78e21379b94f1798acbe9527d7ffa5

SHA1
4469716c7a1a9e94dc96a36d7015f48554698a8e

SHA256
c2d78254aa4091d9d1a0489e421c6999b9e6200cf0e883b138b5c070627c2e19

SHA512
5cb7a6f597f948a8d56daa4df6ca150624a55186b5642d76cca05656fb51d7f7034ce05a0ae8647cbd8dc3592e74b97ab95f7ce50574e532ab1c73416abe8fa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_FFB46CECE484AA2EE6ADD02001DDCE14

Filesize
406B

MD5
714369ad47fc11c81e0b30468b87b00f

SHA1
99de01837101ef67f0fc632fa49810402a5c014c

SHA256
f10784df16ef893511d213468d5fdeecc4e2f6743016374316d5b8a0dc652838

SHA512
1575fd57eb138be396883b750dad21dc25850ba086de23d389240f7242a3dbc1152183d33839edee9110ac3d78cc88268fabd5f1ea77285b8ac1f067e7620c70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Data\10.bin

Filesize
255KB

MD5
c75addd6393f004afa502b0f41866fc0

SHA1
5c1f5b8ae659f67c1b37ba398d7a9b7b42837e42

SHA256
b2cc5dad124c6288a126d19e0d80d82d7d11a6a7c360eb5ee256b26fb160e68d

SHA512
7afd5689b1927ad55f257d3850152787ae5ece2a4332b2e1e12074a864590818f633ea1d1f621d949b17ca91adb43b25afc83f088db7a9fd1588b477af07bd07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Data\2.bin

Filesize
353KB

MD5
8766dce04feb646bf62206d64d6eb0ba

SHA1
91c5d588028c6c949e9cbcec950bcfaa35a791e4

SHA256
f87e1ab69bef059744ee9244f37b0f21ef7d7b06fc5245094cfa22637ef6ae9d

SHA512
0bc8fc880bb94ad55a732f2be207d88a6bb0ae8d97f91819e889d04420a71ae5d91af21861bad351c5fd7f4e944c1899b17df326bf19d310cc31a95fd38ee6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Data\8.bin

Filesize
408KB

MD5
5ada580c290b53327fc8db29d5cd66c5

SHA1
a504aff6a9fa93bf4ccb69df17b5238804c659f9

SHA256
5dcf1f4b285a6dd70ec7acd77eeb5752a3d381a8a697eafd394fcde615f3ba63

SHA512
36da1958e7b4fad5367b257d9343c4eab59d50b01c610514d48eae2d0eeabf7efd06dd8fc63551a0a7e11df91aa3ceb063003cdd9c30c6755431ba218524fd49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Data\9.bin

Filesize
13KB

MD5
f0e3d4ad2f1d09acf314a9e7a92777ff

SHA1
958224c3c98945c38f4e12ad6d1c64c4b91e189f

SHA256
b897644e314b31e0dd5159d061b9e77a512178f29a9f36076ec105e286212bb4

SHA512
28ccc056d2f5bde039cc3502a584cce3baa5cf9700fda8775344935438a6951989b3a24903693ac5e5292ff250cc27f338b783b29191948bed7ff4cc8038c8ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe

Filesize
22KB

MD5
505bce79704649f8bb695b04ef01f430

SHA1
787e714e8a0ddaaf096054dc1466540c47da273a

SHA256
deffe4e7038a0828f4ef1e3a8d9e1963a06215b213d759d239ea7d38ef1f0f0b

SHA512
f9eccd7c801cb411be765a04130c4d32234fff7b0b52cfa93064b61179598e8a729d7e6ad3e5dadb5fbc0a7741926fa55353d04ae04630cb0b35b6806f99e929

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\12.bin

Filesize
4.0MB

MD5
d0a4e7930e6d2e40fcd5483811121734

SHA1
f6fc31a0f0a97a0127d88935141581e2d837502b

SHA256
b6865c734cee2baeea3d3f887905835482780be4bf3db55e127471e2a9a415cb

SHA512
f3fd80718eda484d1351cc81fefe8a0cce8c1131a1b5e5c3a6adf90e9cffc7e72458455f85c510aef77adffcce75ff6b6e0fe76293b38e3cf88cc898e97bc3b8

Download Submit
C:\note.txt

Filesize
133B

MD5
910efec550edf98bf4f4e7ab50ca8f98

SHA1
4571d44dc60e892fb22ccd0bc2c79c3553560742

SHA256
7349f657a8d247fc778b7dd68e88bc8aba73bf2c399dc17deb2c9114c038430b

SHA512
320de5e34c129dd4a742ff352cfe0be2fac5874b593631529e53d5fe513709ac01f5d1d3dfae659f36a2a33aae51534ec838f5d3748cd6d1230a0f3d29341442

Download Submit
memory/2840-51-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/2840-52-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/2840-48-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/2840-47-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/2840-49-0x00000000037F0000-0x0000000003800000-memory.dmp

Filesize
64KB

Download
memory/2840-55-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/2840-54-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/2840-53-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/2840-50-0x00000000037E0000-0x00000000037F0000-memory.dmp

Filesize
64KB

Download
memory/3880-115-0x000001EC49330000-0x000001EC49332000-memory.dmp

Filesize
8KB

Download
memory/3880-189-0x000001EC48F30000-0x000001EC48F50000-memory.dmp

Filesize
128KB

Download
memory/3880-264-0x000001EC38C10000-0x000001EC38D10000-memory.dmp

Filesize
1024KB

Download
memory/3880-113-0x000001EC49310000-0x000001EC49312000-memory.dmp

Filesize
8KB

Download
memory/3880-118-0x000001EC49470000-0x000001EC49490000-memory.dmp

Filesize
128KB

Download
memory/3880-612-0x000001EC49190000-0x000001EC49192000-memory.dmp

Filesize
8KB

Download
memory/3880-121-0x000001EC49DA0000-0x000001EC49DA2000-memory.dmp

Filesize
8KB

Download
memory/3880-123-0x000001EC49DC0000-0x000001EC49DC2000-memory.dmp

Filesize
8KB

Download
memory/3880-614-0x000001EC49D40000-0x000001EC49D42000-memory.dmp

Filesize
8KB

Download
memory/3880-146-0x000001EC4AE80000-0x000001EC4AE82000-memory.dmp

Filesize
8KB

Download
memory/3880-126-0x000001EC49DD0000-0x000001EC49DD2000-memory.dmp

Filesize
8KB

Download
memory/3880-265-0x000001EC4BC00000-0x000001EC4BD00000-memory.dmp

Filesize
1024KB

Download
memory/3880-119-0x000001EC49D80000-0x000001EC49D82000-memory.dmp

Filesize
8KB

Download
memory/3880-109-0x000001EC386F0000-0x000001EC386F2000-memory.dmp

Filesize
8KB

Download
memory/3880-140-0x000001EC4ADF0000-0x000001EC4ADF2000-memory.dmp

Filesize
8KB

Download
memory/3880-111-0x000001EC49150000-0x000001EC49152000-memory.dmp

Filesize
8KB

Download
memory/3880-142-0x000001EC4AE10000-0x000001EC4AE12000-memory.dmp

Filesize
8KB

Download
memory/3880-148-0x000001EC4AE90000-0x000001EC4AE92000-memory.dmp

Filesize
8KB

Download
memory/3880-138-0x000001EC4ADD0000-0x000001EC4ADD2000-memory.dmp

Filesize
8KB

Download
memory/5012-56-0x00000288A2120000-0x00000288A2130000-memory.dmp

Filesize
64KB

Download
memory/5012-157-0x00000288A8D90000-0x00000288A8D91000-memory.dmp

Filesize
4KB

Download
memory/5012-158-0x00000288A8DA0000-0x00000288A8DA1000-memory.dmp

Filesize
4KB

Download
memory/5012-91-0x000002889F790000-0x000002889F792000-memory.dmp

Filesize
8KB

Download
memory/5012-72-0x00000288A23E0000-0x00000288A23F0000-memory.dmp

Filesize
64KB

Download