b7569d56a8ba896cbed8b5f82b8712d15cdf16a892e77db9af19b3b8833a9e17

Analysis

max time kernel
51s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WebPhotoGalleryArabic.exe
Size

167.5MB
MD5

c48de482c0685aafa5c647f4061a802d
SHA1

960e445280d2b5a088822b6cca065f3bddb14281
SHA256

71eb54e617c119a4e57433099651e0fad2df171f7bc6406053b5424f9e260f9c
SHA512

3a030bb052b69c930ca34c89226f3f341e1ef3fcc5b27a37b718b2299c10fae416ae7dcf979fd366d75b673ef7404198cd91484313f999f17cddaa0370d73315
SSDEEP

3145728:VnVTMT5Y6o+irlLEwwHlmNKHccNeueLX58HOVX2oXcXAI84itAOGQISKrN0Ja6hL:zq5QEwwHlmN+Rc1LX5pVX2oU5ZhBOr

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	WebPhotoGalleryArabic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	MSI33E2.tmp

Executes dropped EXE 1 IoCs

pid	Process
3108	MSI33E2.tmp

Loads dropped DLL 13 IoCs

pid	Process
2460	MsiExec.exe
2460	MsiExec.exe
2460	MsiExec.exe
2460	MsiExec.exe
2460	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\K:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\X:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\O:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Z:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\P:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\W:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Y:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\R:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Q:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\M:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\T:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\V:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\G:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\K:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\N:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\R:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\U:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI371F.tmp	msiexec.exe
File created	C:\Windows\Installer\e583042.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e583042.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3257.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI32B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3363.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3374.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI317B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI32E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI375F.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000db5049eb9f24a4820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000db5049eb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900db5049eb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1ddb5049eb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000db5049eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
2356	msedge.exe
2356	msedge.exe
5888	identity_helper.exe
5888	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2912	msiexec.exe
Token: SeCreateTokenPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeAssignPrimaryTokenPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeLockMemoryPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeIncreaseQuotaPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeMachineAccountPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeTcbPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSecurityPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeTakeOwnershipPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeLoadDriverPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSystemProfilePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSystemtimePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeProfSingleProcessPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeIncBasePriorityPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreatePagefilePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreatePermanentPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeBackupPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeRestorePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeShutdownPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeDebugPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeAuditPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSystemEnvironmentPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeChangeNotifyPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeRemoteShutdownPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeUndockPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSyncAgentPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeEnableDelegationPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeManageVolumePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeImpersonatePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreateGlobalPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreateTokenPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeAssignPrimaryTokenPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeLockMemoryPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeIncreaseQuotaPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeMachineAccountPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeTcbPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSecurityPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeTakeOwnershipPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeLoadDriverPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSystemProfilePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSystemtimePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeProfSingleProcessPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeIncBasePriorityPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreatePagefilePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreatePermanentPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeBackupPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeRestorePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeShutdownPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeDebugPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeAuditPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSystemEnvironmentPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeChangeNotifyPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeRemoteShutdownPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeUndockPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeSyncAgentPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeEnableDelegationPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeManageVolumePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeImpersonatePrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreateGlobalPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeCreateTokenPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeAssignPrimaryTokenPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeLockMemoryPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeIncreaseQuotaPrivilege	2408	WebPhotoGalleryArabic.exe
Token: SeMachineAccountPrivilege	2408	WebPhotoGalleryArabic.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2408	WebPhotoGalleryArabic.exe
3068	msiexec.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2460	2912	msiexec.exe	94
PID 2912 wrote to memory of 2460	2912	msiexec.exe	94
PID 2912 wrote to memory of 2460	2912	msiexec.exe	94
PID 2408 wrote to memory of 4460	2408	WebPhotoGalleryArabic.exe	97
PID 2408 wrote to memory of 4460	2408	WebPhotoGalleryArabic.exe	97
PID 2408 wrote to memory of 4460	2408	WebPhotoGalleryArabic.exe	97
PID 4460 wrote to memory of 3068	4460	WebPhotoGalleryArabic.exe	98
PID 4460 wrote to memory of 3068	4460	WebPhotoGalleryArabic.exe	98
PID 4460 wrote to memory of 3068	4460	WebPhotoGalleryArabic.exe	98
PID 2912 wrote to memory of 4456	2912	msiexec.exe	107
PID 2912 wrote to memory of 4456	2912	msiexec.exe	107
PID 2912 wrote to memory of 2112	2912	msiexec.exe	110
PID 2912 wrote to memory of 2112	2912	msiexec.exe	110
PID 2912 wrote to memory of 2112	2912	msiexec.exe	110
PID 2912 wrote to memory of 3108	2912	msiexec.exe	111
PID 2912 wrote to memory of 3108	2912	msiexec.exe	111
PID 2912 wrote to memory of 3108	2912	msiexec.exe	111
PID 3108 wrote to memory of 2356	3108	MSI33E2.tmp	112
PID 3108 wrote to memory of 2356	3108	MSI33E2.tmp	112
PID 2356 wrote to memory of 3520	2356	msedge.exe	113
PID 2356 wrote to memory of 3520	2356	msedge.exe	113
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 448	2356	msedge.exe	114
PID 2356 wrote to memory of 4004	2356	msedge.exe	115
PID 2356 wrote to memory of 4004	2356	msedge.exe	115
PID 2356 wrote to memory of 4216	2356	msedge.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe
"C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe
  "C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe" /i "C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ "EXE_CMD_LINE=/exenoupdates /forcecleanup /wintime 1710626306 " CLIENTPROCESSID=2408 CHAINERUIPROCESSID=2408Chainer ALLUSERS=1 "AI_UNINSTALLER=C:\ProgramData\Caphyon\Advanced Installer\{DEFFB9AA-5E58-4B78-9DDC-26B20F415404}\WebPhotoGallery.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1710626306 " CLIENTPROCESSID=2408 CHAINERUIPROCESSID=2408Chainer ALLUSERS=1 AI_UNINSTALLER="C:\ProgramData\Caphyon\Advanced Installer\{DEFFB9AA-5E58-4B78-9DDC-26B20F415404}\WebPhotoGallery.exe" AI_UNINSTALLER="C:\ProgramData\Caphyon\Advanced Installer\{DEFFB9AA-5E58-4B78-9DDC-26B20F415404}\WebPhotoGallery.exe" AI_EUIMSI=""
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3068

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 879269D4E1C5547AB637E5ADB3F3B830 C
  2⤵
  - Loads dropped DLL
  PID:2460
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BB315B1D0E81B2C36F04BDAEFBC1F099
  2⤵
  - Loads dropped DLL
  PID:2112
- C:\Windows\Installer\MSI33E2.tmp
  "C:\Windows\Installer\MSI33E2.tmp" https://webphotogallery.store/log.php?clickid=1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://webphotogallery.store/log.php?clickid=1
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcc4546f8,0x7ffdcc454708,0x7ffdcc454718
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16339252574627343686,1148877888400162454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
      4⤵
      PID:6032
- C:\Program Files (x86)\AiSoft\WebPhotoGallery01\WebPhotoGallery.exe
  "C:\Program Files (x86)\AiSoft\WebPhotoGallery01\WebPhotoGallery.exe"
  2⤵
  PID:3004
- C:\Program Files (x86)\Common Files\Release\msedgwebview2.exe
  "C:\Program Files (x86)\Common Files\Release\msedgwebview2.exe"
  2⤵
  PID:5872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x454
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e583045.rbs

Filesize
52KB

MD5
4f294698d2e40d7254f18cc3855d4a34

SHA1
c57071667f3e5cc0424b09bb4db03ea1df00c065

SHA256
fd3ea946b3b85baaec6648d9c5805c8f2e4bb42335adfa0435d013dd8cec4254

SHA512
3f4e0861c6c0d27542c8146de838b9d10919b60ec0528d74f2cf12f72f90925b8eba604adfa8c29da41b9aa310adc2a1ccd6f5ae966ad2ae77da3044954fdafa

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Data.v23.2.dll

Filesize
640KB

MD5
b7a8f86c8fdfe90264fd941501ac600a

SHA1
bb3a9d3716380e638e83f393ba520022a32fc76b

SHA256
1968ab0b38f21feaeb5e957220a7fb84294592a6be57c62000967dd43a70f34d

SHA512
a2167099e5316725b964f1af3241343a9b1c2610b7c077ea096dbc76907a7cd92b5fa21969f28e51ebc6985d085eb6612eb374b7d0cdd924672f343382a8b784

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Data.v23.2.dll

Filesize
576KB

MD5
8c30dafbec62d26a2a28635c43164ef5

SHA1
4feed7f43b37db2391b14984b8efaa7601d27072

SHA256
3e15b11749d044c45ed3e46f16df976a60ee4a8d770b11bca114098e3b76f303

SHA512
21da1dc2e12953423096f432437bf13f96ef6d48c20a26cabd7f56f409365fd606ad2dde389c0b9e436eb42b5fcffda0119fec31a69a9fd0d8d5afade0c2e8d6

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Utils.v23.2.dll

Filesize
512KB

MD5
ca6e739bf8df58d1273b3676d5a11771

SHA1
ddee9e0587dae043c749dd9a3a1248e61075c54d

SHA256
c7d6beb6476ce6a82fa3cd06ce0e819f81c7366b10797f633573b7ae55b536b1

SHA512
28211429ca67802892cd570954e9042fd1dec641d209ed8282870b62cf9c0490502abbeaff871d7c6b783100982979297e3a3d3bd1855d4b95f83c8c09f57a8a

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Utils.v23.2.dll

Filesize
1.4MB

MD5
e969ec3733b437ac035650fd35ecfe20

SHA1
ef8b6fcee0772a4d9291170463576f6dc47a7412

SHA256
40de6962653158bf79d33740131ab1ef5cd1229d9a7a8ed86913e94eb0f97010

SHA512
5a0e74af743debc00c8c14a9673c0ba561ef56a6b844bc3508f10096487280b8eae0da440a786dcc62671fce3cd9d1ed5e1770890a9db760456c122c4ee4d237

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Utils.v23.2.dll

Filesize
1.1MB

MD5
998240306c30696c3c514bd539f11ebc

SHA1
f735b2c5d9e3f3d7ade2121e1207b70ffd588dd4

SHA256
0659e6dedcc51050a03c8a1c5cc19fdccf4d3f7ee141399b1d4d26cc82735d0c

SHA512
f2fcf4d7204b9aeb3271a751a9376f086763f0d0bc3134f9d4f798fa3647b03b8f6fdf48b68c5b526fe5ade37d26ce0eb1e0b12206824aefc008b001a031d4ad

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Xpo.v23.2.dll

Filesize
960KB

MD5
1d5f9db667ef07fc24c4b4c6dbc67cbe

SHA1
8b60a070c00e90ffc12cb7753eb2610f17cc27ea

SHA256
d7b0f5671a150b72c37bbd2c693960e5e4f29a2cd060b0a66332f48bb35be056

SHA512
5729233c3527f718816d28c300fd613066a5b1fddfea2fc35259fa774e25f69ceeaf4906cd1ebb4f2a5771ec193003f13c4a4068048ba33c604baddd5271c924

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraBars.v23.2.dll

Filesize
2.8MB

MD5
682fee3f9c0f574d4b038e3d46a9ef42

SHA1
36cf0abc825319b71895900d5971eb6c0055f564

SHA256
05ee662956950366fa31c315e08440e436f24320f3d27a1e95592e27e544eba1

SHA512
a103d1075dfedc50eeef7a29dc167de34cb7f5409490ba5df3e1d283fd08af355c04ccbf084e7883f96025da42ef9595499b7608f0e7b922159702c2dc2ccb78

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraBars.v23.2.dll

Filesize
2.6MB

MD5
b361953e4e818cfc6cf492fe91ed0707

SHA1
7cccee7fe91cc824ff3840b532d572fd06b9ed25

SHA256
695d1c5510517d4d33c8186622a7ba0ff29ca5da3f22cdd148ced1d35bf6f117

SHA512
7f57e2d53b522a68371373a33dac8461201f834a1f344b57b84d36eaf1f9b96a9c31ecdcf1b7e1cb46ebbc645d78a1c6ad9d54862e1f25b3c829f6bd2483b3d0

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraBars.v23.2.dll

Filesize
320KB

MD5
8a7a77b1dad65f5aa4d16d6bfa5f8078

SHA1
88b56ab1b58364712362a5fbb6c20b0a80ac8ed3

SHA256
36c5ee85eb52af029d033c22f66efb526a95791f8f9e7d58db328351fca31ba3

SHA512
bfe86583b83a906335ae9d4cc9a65abc6bc3a058da6bbee26b367504f24a1bc87998d6fd664c9b6c23c2210bab7a341548dc7d1049bf09f7d1cf35405cd7085d

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraEditors.v23.2.dll

Filesize
320KB

MD5
c90a4f9720a1556b7a21fe1a5ba3217d

SHA1
2bcf94c4bb9161429f7fbeb1e92220133b83233e

SHA256
d60a3c254d56b8f063103f01796ef4e3d9db28bd26acc1591cd43d7f4b49b690

SHA512
2da242f7bc37bb1a4ec47555b7f924b0e9467b27eac5a464e124968d96b3acba8b4c9d6e3d3d2e6cfec13275022353d23c3534d1f7f393401ad2d6fb146496d7

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraEditors.v23.2.dll

Filesize
384KB

MD5
faf58df4a062d2e8596fd5fe9b277a3e

SHA1
0e3c5752a43761ae4ae66ff905dc783569240419

SHA256
047a130944b099efeb092f7bd79f41aa51400336714572b941645767a5fe7568

SHA512
2dfc3417060842dd3d45be3bce1a0f22d0b4e83804707b23736937f3810faab672d7da546b443d660b2e4e5fe1d303605a859e0300f1a50d02b2f54135c1f612

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\WebPhotoGallery.exe

Filesize
2.6MB

MD5
7fed84fafc61dd286047a2006f41478f

SHA1
651a502a81abad9b868bfc9da8e7edf3443934a4

SHA256
067115c60b645bdaf7200ce0eb8d23aeb2ea3e181623f880c0ee08a9d78c39d5

SHA512
4c47e8bf5dc6c5cd65e78401d18d93aa7c981fcc93f3f07b89845a9cffb23ccfe03f66b99ab30440f042db7f7a6aae9f47685823a49a37321d11d3fcdb356d84

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\WebPhotoGallery.exe

Filesize
1.4MB

MD5
be41dc790cd894896d2da9cc16ac3d12

SHA1
efa105cd2353a74b0678b66c8fdd50a7cac05a6e

SHA256
a03ec2bdbdb696e2ea14c6b4a693376f3a871ead96622a4361221c59ab63c277

SHA512
d5121e22714de612245f4e11001d9148cb6f193528f922048455f496ffc8e4d75f679eab790233b8ce12f3e5c78f51efe29909ae5d7984183dd6524fd16627c2

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\WebPhotoGallery.exe

Filesize
896KB

MD5
ae94f90a2cefa0f05ff04100266e98ac

SHA1
6caa251e3521f3ff1c0fea06abb2752044d07708

SHA256
3af95cad9a3da65e22ddf0e0a76edd20f34ad4c7735c7ad560ee831b5ce63fc2

SHA512
a7fd50e9d8e0c6ff4de12ff970e5d46176b3b73c6bd734d69c0f0208072abb3e42900594b198b797cdf6c37ad0ab0c2e350515ffd4d46dbf2c0c12af65bd9104

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\WebPhotoGallery.exe.config

Filesize
5KB

MD5
a40a63d68a45170289287be03d350766

SHA1
fe80cc0b19d33b1176ef7620f6fa61753a9b9faa

SHA256
38e059171821a8894ca68a8e0ac0d33ba1973fea56671fdc9fb2c630ce1c4c77

SHA512
a1139666c562981d6c8e6973c780782b4bc179e10774d5c13c20d04300024421be4ee929736eac8873f1141c92a7ec6a463243e75138b191575246c0587b0dfd

Download Submit
C:\Program Files (x86)\AiSoft\WebPhotoGallery01\WebPhotoGallery.pdb

Filesize
14KB

MD5
3f584a5f3ddc69865b8d919dd899cff3

SHA1
71c4969c948b3260bd97556864dab643bbf38457

SHA256
31701fa05c8b5d5bd8d604dfe968752e421f91a044e6a2b581b9626771e44f00

SHA512
f023be66bf30b232b39219613b0fc5c86d530a5cff995bea5f776922e4305d39682356a88f7416c8f797403f59123e6a78613d7ac0c9ce3c3b9a1ce41f3bd3eb

Download Submit
C:\Program Files (x86)\Common Files\Release\msedgwebview2.exe

Filesize
16KB

MD5
eb303887aac73a50c3cdbbc1c8081049

SHA1
8109856f12629b7dc5bbdcfc9cea57e8e9b34738

SHA256
71fface605b14d7171c5548dbac9d4153aff6251daf34c80880d10d91ec0c398

SHA512
cc6a96c2b17b545bd5a62782e2aebd788b9e78fa87ed1e7671d39f398e6bf1cc1c8b224913019289d8835f6284fd10cd3579acdedbad1f927e858f9feb4fb4c5

Download Submit
C:\Program Files (x86)\Common Files\Release\msedgwebview2.exe.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
20790ae161527540ddf0a9a4c97b8250

SHA1
6529ccde271ef228bf3687255ef2bcb26a9ec5bb

SHA256
33ea37d4544283b83bea7afe3056daeb7788dcf7603d9ac1fa27ba3b392ee50f

SHA512
cf8ad52ce3398b89e2e7dfd81a808cdae87cbf508a160dacd68fa4d3c57773f530cf652c4650cdc6d39788cac1f41bea96ee250664e3e686c168acd2f1d1a805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bbb7c448566938d9359bbe081b7c1bd9

SHA1
3e6d31ccf9ef157aafeae08e3ddc12508af07812

SHA256
a78d95140fa2aebf82c8aafe99decb3c0f1235186b1898ea4ef9b18fb2b73878

SHA512
bafb8ef99c80c7e8227211ccdd61a5e23313493c3242c2d4f5083c13f0f4d0d9a08b4b4788695031e554649eda0c9d80206a6b19e91028b6f898ce9cd70e42b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36899252ae384416d7390b56b3713396

SHA1
8544d4fda90ac16978cba3e6c449d68c74c769a7

SHA256
da5c9b41089e2e8719d4cbf5f9eab4474d856b48d9c4a66c23d6f742ad58eeab

SHA512
1bc287afc4ad77a9fe2454fc0ef5323dc019895689890e6c03f9c1c8662588c8dbec9f6ec8fbc3b16f36894e2e3a5fa38f6451e2ed1ccd832e58fb004dfd4247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5b2d50fb7b693019b948a02eb2cce92e

SHA1
3c665a521ef700a5504707216744648b35b47dac

SHA256
1cf913119b121e3cf6155ee57d304d2de510153fc64ba76354da61ce47106828

SHA512
164a527c12c06f3938290395f63b82cea3c66fd01ad1a26738e3d87808f5906fdb070b0f78b9c54d26b185339a44211c1708b924576e2263210fd7a4afe63c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
001346e613f37158ce2fc31747e637c4

SHA1
5380c9b82f4fa3442be85a51a484ae9bbc25c522

SHA256
a31ade9e5bb5e770ff7aec074d3b249e6c6de24d48e56b3db8b105b988435318

SHA512
f773e285b713566b50d70c452aff3a6f99edf701b9ba28d8cfaafa2ecd07c913fbc7cfe46ed11084e1522935731592bece24b726d1ce52f0fddc26f1f4873b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_bottom_left.bmp

Filesize
66B

MD5
1fb3755fe9676fca35b8d3c6a8e80b45

SHA1
7c60375472c2757650afbe045c1c97059ca66884

SHA256
384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21

SHA512
dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_bottom_left_inactive.bmp

Filesize
66B

MD5
821930553ef406b0c82d9420d3351c78

SHA1
8511c65f0048f8f30797a13b3d7d8264c314cbd4

SHA256
d5e9f3533cb7d727611aafaa5af22fa07efeaec0391a011ecf9803bed867de7a

SHA512
9d55bb01e40bb411321e60fbb1e60748a7243392456030d81f853448af0af75e27ef87455ad1eebf96af754e803aabd1a82f0653deda52832769f5b74171d9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_bottom_mid.bmp

Filesize
66B

MD5
71fa2730c42ae45c8b373053cc504731

SHA1
ef523fc56f6566fbc41c7d51d29943e6be976d5e

SHA256
205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd

SHA512
ea4415619720cc1d9fb1bb89a14903bfd1471b89f9c4847df4839084aae573d49b4969d3799ad30ff25b71f6e31f8d9f30701e1240d3cd6a063819c04873f21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_caption.bmp

Filesize
206B

MD5
8641f45594b8d413bf1da25ce59f1207

SHA1
afebb23f5a55d304d028ca9942526b3649cddb52

SHA256
0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707

SHA512
86a5f959f8462f866466dc706d3ae627b1fb019b8a33ee7fe48e3b69f92bf33dc0f1417c0d5116552b25b488bcb5d9050a33773e6883ebe08410267d95b2353a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_left.bmp

Filesize
66B

MD5
30384472ae83ff8a7336b987292d8349

SHA1
85d3e6cffe47f5a0a4e1a87ac9da729537783cd0

SHA256
f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a

SHA512
7611f930a0a1089cc5004203ec128c916f0c2aedae3a6fcc2eaffa8cd004dcbf154714e401947921a06896ca77c77daec7f9bda82369aacd3bb666f8a0331963

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_left_inactive.bmp

Filesize
66B

MD5
4b84f29fbce81aab5af97a311d0e51e2

SHA1
60723cf4b91c139661db5ecb0964deca1fc196ea

SHA256
c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55

SHA512
775eadccc44fddbd1e0d4231bc90d222f0a9749199e1963449ad20285ea92941a5685cdc12c0cd8c0ef0a21e10bdacaf139e5c69cd5e402cc110679323c23df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_top_left.bmp

Filesize
154B

MD5
1966f4308086a013b8837dddf88f67ad

SHA1
1b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190

SHA256
17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741

SHA512
ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\frame_top_mid.bmp

Filesize
66B

MD5
4e0ac65606b6aacd85e11c470ceb4e54

SHA1
3f321e3bbde641b7733b806b9ef262243fb8af3b

SHA256
1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee

SHA512
7b28bcb4e76af3b863a7c3390b6cd3316c4631434e1d1e2df8d6e0eb9987a61a4f1a24de59567394e346d45e332403a0817ed0b0b64d7a624dbe48e30db9bb64

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\sys_close_down.png

Filesize
273B

MD5
f6a5e71e9cbe8d3654a2cdf91aae98fa

SHA1
8871a1ae25cff6c5a3e6288a58fc5f4d7a92409d

SHA256
4801d63bd9bdc6279765ba785b0da9e10730764a9c3645934a46c691547c0612

SHA512
1b3146dfdef9c46123f27fa355790036f296d600bb10fbad12363c71c8e3a840863512f4a581daa18ffabb3ec5a3720a6337c4bac54be8b9b49d161b9459a1c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\sys_close_hot.png

Filesize
276B

MD5
17242d201d004bb34449aab0428d2df1

SHA1
77a332c6a6c4bfc47a2120203cfeabb8a2268a6b

SHA256
15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033

SHA512
605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\sys_close_normal.png

Filesize
225B

MD5
8ba33e929eb0c016036968b6f137c5fa

SHA1
b563d786bddd6f1c30924da25b71891696346e15

SHA256
bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5

SHA512
ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\sys_min_down.png

Filesize
205B

MD5
5e947815d865acf099fa753283e09179

SHA1
7d98046d20a73439c53044e0ebb5f0b34afaeea9

SHA256
c1d0663131fe901d890cdd9f18af8f9a553bee4848cbd978f5122e8383b5534b

SHA512
b22e31c37d84128b271c5e5a70fdce90a3bbc02059d1bd032841b3383dbeeca56ec9abe6335453abc8ded1de84e6fcafb648d76d4dcc79246339e9a5eb6d5270

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\sys_min_hot.png

Filesize
180B

MD5
1a883668b735248518bfc4eefd248113

SHA1
1112803a0558a1ad049d1cac6b8a9d626b582606

SHA256
bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e

SHA512
d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\sys_min_inactive.png

Filesize
175B

MD5
a2c4802002bb61994faabda60334a695

SHA1
0a2b6b0ceb09425080c5ba4b9cbdef533cf69eba

SHA256
a3b59dbc5a39d551455ff838e71b5820560ca3484c6411b9d69df33d8113619c

SHA512
34e130edc650c3de6020f2d2b5dc1404b7aee0105eb7e315c15c5aa61398d174377e9b6a2aecc55f79f54c04812b8745c6739a201539e291538979e6b024da31

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2408\sys_min_normal.png

Filesize
238B

MD5
516172d0ebf941237cef32fcee8cdf43

SHA1
6bee117996c16c7413be876dfc15978d14813091

SHA256
56e64eaf6349ece08005e6f7299de413ed00112d53518215d90690be2b2a4f1a

SHA512
46477a58aa7e9eeae29e1c1d826bf045422709b7c8f428985c617b366012c58121d4404523a75efe77fc6d8e061a6bb209743d0a2af81545898f51c8855728ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAEA0.tmp

Filesize
588KB

MD5
b7a6a99cbe6e762c0a61a8621ad41706

SHA1
92f45dd3ed3aaeaac8b488a84e160292ff86281e

SHA256
39fd8d36f8e5d915ad571ea429db3c3de6e9c160dbea7c3e137c9ba4b7fd301d

SHA512
a17e4512d906599b7f004ebb2f19ee2566ee93c2c18114ac05b0a0115a8c481592788f6b97da008795d5c31fb8d819ac82a5097b1792248319139c3face45642

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB038.tmp

Filesize
1.1MB

MD5
8e3862ecc7a591df93cb916906eae863

SHA1
1c9f1f80be421f8c87662b5ab11749dd7604fcf2

SHA256
b980c67b11cc39f006535303151273749e4ca69dd370cf45b6110a0b5af77b68

SHA512
5d58c26f1f4ed448578e118c526a67159284e68b58062a0ff74492a38785fc94608ca09aadb5473f66dd0161fccdbad3ea4a2ed5c65396bef5e3d6572ac607ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB347.tmp

Filesize
736KB

MD5
8dd026145833182777a182a646df81f3

SHA1
4f5cb840193eea97df088c83a794fb6e8f67ab07

SHA256
3071af6be43a2611db45205f0d3f1f25aba05acf5f70992fce2fffd63ee9c85d

SHA512
f6c860bf563a24c046a7d76a6bc1e2f6bbfc80a87ac4513de331049f35198dcbbdbb5be7f5d49100e1d1c8ab680ecf3eaaa4fdb8f744c9fd5479a1ba64079391

Download Submit
C:\Users\Admin\AppData\Local\Temp\shiBC2C.tmp

Filesize
4.8MB

MD5
77d6c08c6448071b47f02b41fa18ed37

SHA1
e7fdb62abdb6d4131c00398f92bc72a3b9b34668

SHA256
047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b

SHA512
e1aeb8e8b441d755a119f45a465ca5660678f4131984322252bfb6d2cec52e7ee54d65a64b98429b23915eb5707b04b5cd62a85446c60de8842314130a926dbd

Download Submit
C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.aiui

Filesize
128KB

MD5
bb9911a6b21c232d1304d7a4d8af8b4b

SHA1
c0263d9724e8dd80d8a56916047fd10328afb58c

SHA256
0440137075f21fe992349d07a3238bcada58f2d662153fbb383cd29716153954

SHA512
31d9397a328c9eeef8fc84a7be0998fb8d7b389c2cd4fc928811742adbed333ef653c737553f9cc6a81fb116944ad039a4261a1654367a0968fec04fe7b70a5b

Download Submit
C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi

Filesize
2.8MB

MD5
a17e517c56309ed6e34897517fc16646

SHA1
209de649f6daddc6f990d8ff3abe228edbb988ad

SHA256
f0a52b8248db1754bac80b6832f3ad047ccc6d5a3a115879ae735ef720fa4f4e

SHA512
a0f8d8bb5c1110cdffd1a65748417d6390ee78e4210f9153308ac19b1be78c0857452dd2c73b8666da8105ab3f752813f15d086a84a88e0a4920cff3e82f1b5e

Download Submit
C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi

Filesize
3.5MB

MD5
fde611d26e23151614541400b136bd57

SHA1
66fba422787f65ae6314663f345ca68678dbdd03

SHA256
d17c550338b309f673cfbdcd49edf69d825c98d4de20638a2de38185f336ee86

SHA512
c511cfde784f2710bc5c75eeb103afdb7018f3d0f8dc6ff43691be98b496f10ba4ad430a9ad84299eb921be0d6a5d98bc6297ca6db8e4698acbd63f423504851

Download Submit
C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery1.cab

Filesize
960KB

MD5
9ef50f4ed5bc83ad0d54e23e2f57d14c

SHA1
989141e75e7c84941b7d4b83737c02e8f23d0089

SHA256
3596975e0cfad9d9bcc3cda49d1c30745a63a6f3c7b34ff2a043544b1b3b726a

SHA512
845e50dfb8e38e965c5fcb28844a9dea89652a2898857f51fe399f6353fb0617fe114275fe358511e5ce5b0a42fce01542dbd06ebba8904c0e2885d8d2943fb6

Download Submit
C:\Windows\Installer\MSI32E5.tmp

Filesize
320KB

MD5
a6d2e7150818f3d2d21c29e66eed4494

SHA1
932e1fa22a1161eabb9d34931090c08f4df75e55

SHA256
4344cd1fbebf8caf4a2e2299925117397139d7b7a9d15d7811d20c73018e6ef3

SHA512
0c241fd4c4c81cb8cb3d35c4600f48d6b052982d214aaa86bd5811909f4742c9c4f3f5c4bc47d1d220cb31fb31d476dc83604c4cad22bfb74123172396cfb9fb

Download Submit
C:\Windows\Installer\MSI32E5.tmp

Filesize
384KB

MD5
efddc21320c1f8c32fc322f3ca609f16

SHA1
e22f2ff01e6f35fce5d439a83b1956d6fbb14740

SHA256
d6dbdcf286232629507425d63625a13024d7213a1932e7d6361c144b9a8b2061

SHA512
491b881979ffb9ca972fab1fbd051ec3d3eaa5f9f0197e7f35833ed3dbe3077cfdb8b102885a35a71c079976ef4f96973c4950396a7cc8d49c73c4615b7cd9ed

Download Submit
C:\Windows\Installer\MSI33E2.tmp

Filesize
426KB

MD5
7ccfb5fbbb3b769867f5131c75de07f4

SHA1
764aba63906630e3e4e460ac1d2cadd7c2c57597

SHA256
533671c03f5d4651ceb57f00004f0b52286b9a20f17d24cd35d6230474861d93

SHA512
6d9e51cd742120d3f2abf2f179e4ec71222a92821bf13f7fca5147f5325ef82ef7b09ab1fea19ed00a108aaa08c5546e50d8dd5e1a89a8da34e66af445deee11

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
9.9MB

MD5
1a9af4c8181acb24e75ec5c93fab7e90

SHA1
b3511f71ae765b172f6a0f06740cc14685cf9360

SHA256
04724bee0392b93c9520c7bb0fcb47aad769aa3c511f1886de8ad2848fa003f5

SHA512
da5afc5e4332ed32c7e65023ee7d15caa0f63732f39c1bc12d07a14ead53c6f7db24e1bf3fdbf2b47287e6c5cc0cc06f3525a0527d39ff84ee6cbb585da3b1e1

Download Submit
\??\Volume{eb4950db-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e4b1cdd5-8c23-4dda-8790-7470ffdc2b5e}_OnDiskSnapshotProp

Filesize
6KB

MD5
f927be0c0184339ec3480d9e2dc6a03b

SHA1
9bd9af3ba0fbb1d78324b7cef78c33a85a457f81

SHA256
09647ea7cb8f39e3cba3c3d09bf47c69ca810c8b181e5a9445a9ce4a95bbc54f

SHA512
7507810d125a002d7e8d5ef94264cbf2f5f6918261e93db8058420da0ceb92f48c2e118f2b1a9912089f204a918f4f26badcdcf1eb12a065bcd8621a925404a8

Download Submit
memory/3004-915-0x0000000005AF0000-0x0000000005B00000-memory.dmp

Filesize
64KB

Download
memory/3004-922-0x000000000D950000-0x000000000D98C000-memory.dmp

Filesize
240KB

Download
memory/3004-975-0x000000000F0E0000-0x000000000F102000-memory.dmp

Filesize
136KB

Download
memory/3004-776-0x00000000002E0000-0x000000000058A000-memory.dmp

Filesize
2.7MB

Download
memory/3004-905-0x00000000067A0000-0x0000000006CEE000-memory.dmp

Filesize
5.3MB

Download
memory/3004-974-0x0000000005AF0000-0x0000000005B00000-memory.dmp

Filesize
64KB

Download
memory/3004-912-0x0000000006F30000-0x000000000716C000-memory.dmp

Filesize
2.2MB

Download
memory/3004-900-0x0000000007B30000-0x0000000008EBC000-memory.dmp

Filesize
19.5MB

Download
memory/3004-779-0x0000000071480000-0x0000000071C30000-memory.dmp

Filesize
7.7MB

Download
memory/3004-973-0x0000000019820000-0x00000000198D2000-memory.dmp

Filesize
712KB

Download
memory/3004-972-0x0000000016330000-0x0000000016338000-memory.dmp

Filesize
32KB

Download
memory/3004-913-0x000000000AC40000-0x000000000C1D6000-memory.dmp

Filesize
21.6MB

Download
memory/3004-914-0x0000000006CF0000-0x0000000006DE8000-memory.dmp

Filesize
992KB

Download
memory/3004-962-0x0000000014840000-0x00000000148EA000-memory.dmp

Filesize
680KB

Download
memory/3004-916-0x0000000006DF0000-0x0000000006EE8000-memory.dmp

Filesize
992KB

Download
memory/3004-813-0x00000000060F0000-0x000000000679C000-memory.dmp

Filesize
6.7MB

Download
memory/3004-917-0x000000000D370000-0x000000000D6C4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-918-0x000000000DCF0000-0x000000000E308000-memory.dmp

Filesize
6.1MB

Download
memory/3004-921-0x000000000D700000-0x000000000D74C000-memory.dmp

Filesize
304KB

Download
memory/3004-920-0x000000000D8A0000-0x000000000D90A000-memory.dmp

Filesize
424KB

Download
memory/3004-923-0x000000000D910000-0x000000000D931000-memory.dmp

Filesize
132KB

Download
memory/3004-909-0x0000000008EC0000-0x000000000969A000-memory.dmp

Filesize
7.9MB

Download
memory/3004-919-0x000000000D7D0000-0x000000000D89E000-memory.dmp

Filesize
824KB

Download
memory/3004-924-0x000000000F490000-0x000000000F83C000-memory.dmp

Filesize
3.7MB

Download
memory/3004-926-0x000000000F840000-0x000000000FA54000-memory.dmp

Filesize
2.1MB

Download
memory/3004-927-0x000000000E310000-0x000000000E3F8000-memory.dmp

Filesize
928KB

Download
memory/3004-925-0x000000000FCB0000-0x0000000010118000-memory.dmp

Filesize
4.4MB

Download
memory/3004-928-0x000000000C470000-0x000000000C484000-memory.dmp

Filesize
80KB

Download
memory/3004-930-0x0000000005AF0000-0x0000000005B00000-memory.dmp

Filesize
64KB

Download
memory/3004-940-0x000000000F360000-0x000000000F380000-memory.dmp

Filesize
128KB

Download
memory/3004-929-0x0000000005AF0000-0x0000000005B00000-memory.dmp

Filesize
64KB

Download
memory/3004-941-0x000000000F3D0000-0x000000000F3DC000-memory.dmp

Filesize
48KB

Download
memory/3004-942-0x0000000011150000-0x000000001115E000-memory.dmp

Filesize
56KB

Download
memory/3004-952-0x00000000112E0000-0x00000000112F2000-memory.dmp

Filesize
72KB

Download
memory/3004-961-0x0000000011E00000-0x0000000012670000-memory.dmp

Filesize
8.4MB

Download
memory/5872-819-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/5872-778-0x0000000005E00000-0x00000000063A4000-memory.dmp

Filesize
5.6MB

Download
memory/5872-820-0x00000000057E0000-0x00000000057EA000-memory.dmp

Filesize
40KB

Download
memory/5872-812-0x0000000005850000-0x00000000058E2000-memory.dmp

Filesize
584KB

Download
memory/5872-777-0x0000000071480000-0x0000000071C30000-memory.dmp

Filesize
7.7MB

Download
memory/5872-775-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download