amadey | c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
31-03-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
Size

1.8MB
MD5

adde558172b7f7c3a4276c54cbe4483b
SHA1

96f0184995d56f17f884ab1515ef431ce34b6290
SHA256

c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921
SHA512

2aa8ac899b25dbde5bfc2fcbc5ec096a2403d144d9221f71654efcad6db3924b81bc55923888a062e554e254c7a3a101b27b285a933847eafb1099446f4ce5b3
SSDEEP

49152:+jPuOF2x1ozdlRiTQBKMJo6WZtVOfTlj49BLU7VlFu3:+72DozdTiAKw2Oxj49BLU7VlE3

Score

10^/10

amadey risepro discovery evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4b8aac482b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
50	5644	rundll32.exe
58	3820	rundll32.exe
68	5300	rundll32.exe
73	5596	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4b8aac482b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4b8aac482b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe

Executes dropped EXE 8 IoCs

pid	Process
2968	explorha.exe
3884	4b8aac482b.exe
1352	go.exe
5812	amert.exe
4888	explorgu.exe
5876	explorha.exe
6052	swiiiii.exe
5480	explorha.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Wine	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
Key opened	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Wine	4b8aac482b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Wine	explorgu.exe

Loads dropped DLL 6 IoCs

pid	Process
5624	rundll32.exe
5644	rundll32.exe
3820	rundll32.exe
5292	rundll32.exe
5300	rundll32.exe
5596	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\Windows\CurrentVersion\Run\4b8aac482b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042001\\4b8aac482b.exe"	explorha.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025c82-59.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3220	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
2968	explorha.exe
5812	amert.exe
4888	explorgu.exe
5876	explorha.exe
5480	explorha.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6052 set thread context of 6024	6052	swiiiii.exe	127

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorha.job	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
File created	C:\Windows\Tasks\explorgu.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	6052	WerFault.exe	124

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3220	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
3220	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
2968	explorha.exe
2968	explorha.exe
4332	msedge.exe
4332	msedge.exe
4260	msedge.exe
4260	msedge.exe
4904	msedge.exe
4904	msedge.exe
1292	msedge.exe
1292	msedge.exe
5644	rundll32.exe
5644	rundll32.exe
5644	rundll32.exe
5644	rundll32.exe
5644	rundll32.exe
5644	rundll32.exe
5812	amert.exe
5812	amert.exe
5644	rundll32.exe
5644	rundll32.exe
5644	rundll32.exe
5644	rundll32.exe
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe
3412	msedge.exe
3412	msedge.exe
4820	identity_helper.exe
4820	identity_helper.exe
4888	explorgu.exe
4888	explorgu.exe
5876	explorha.exe
5876	explorha.exe
6024	RegAsm.exe
6024	RegAsm.exe
6024	RegAsm.exe
6024	RegAsm.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
5300	rundll32.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
5480	explorha.exe
5480	explorha.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
3220	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
1352	go.exe
1352	go.exe
1352	go.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1352	go.exe
1352	go.exe
1352	go.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 2968	3220	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe	78
PID 3220 wrote to memory of 2968	3220	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe	78
PID 3220 wrote to memory of 2968	3220	c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe	78
PID 2968 wrote to memory of 3884	2968	explorha.exe	79
PID 2968 wrote to memory of 3884	2968	explorha.exe	79
PID 2968 wrote to memory of 3884	2968	explorha.exe	79
PID 2968 wrote to memory of 4576	2968	explorha.exe	80
PID 2968 wrote to memory of 4576	2968	explorha.exe	80
PID 2968 wrote to memory of 4576	2968	explorha.exe	80
PID 2968 wrote to memory of 1352	2968	explorha.exe	81
PID 2968 wrote to memory of 1352	2968	explorha.exe	81
PID 2968 wrote to memory of 1352	2968	explorha.exe	81
PID 1352 wrote to memory of 4132	1352	go.exe	82
PID 1352 wrote to memory of 4132	1352	go.exe	82
PID 4132 wrote to memory of 2176	4132	msedge.exe	85
PID 4132 wrote to memory of 2176	4132	msedge.exe	85
PID 1352 wrote to memory of 4260	1352	go.exe	86
PID 1352 wrote to memory of 4260	1352	go.exe	86
PID 4260 wrote to memory of 720	4260	msedge.exe	87
PID 4260 wrote to memory of 720	4260	msedge.exe	87
PID 1352 wrote to memory of 5072	1352	go.exe	88
PID 1352 wrote to memory of 5072	1352	go.exe	88
PID 5072 wrote to memory of 1672	5072	msedge.exe	89
PID 5072 wrote to memory of 1672	5072	msedge.exe	89
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90
PID 4260 wrote to memory of 2272	4260	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe
"C:\Users\Admin\AppData\Local\Temp\c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\1000042001\4b8aac482b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\4b8aac482b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
    "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd37d3cb8,0x7fffd37d3cc8,0x7fffd37d3cd8
        5⤵
        
        PID:2176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,8239217815951701857,2924047070964777000,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:2
        5⤵
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,8239217815951701857,2924047070964777000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd37d3cb8,0x7fffd37d3cc8,0x7fffd37d3cd8
        5⤵
        
        PID:720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        5⤵
        
        PID:2272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
        5⤵
        
        PID:1412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
        5⤵
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
        5⤵
        
        PID:1548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
        5⤵
        
        PID:908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
        5⤵
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
        5⤵
        
        PID:436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
        5⤵
        
        PID:5952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        
        PID:5960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
        5⤵
        
        PID:5344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6496 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6648 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,9356782304226380450,14336129075196258809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3272 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd37d3cb8,0x7fffd37d3cc8,0x7fffd37d3cd8
        5⤵
        
        PID:1672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16281791222301273475,12317995066059208800,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        
        PID:8
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,16281791222301273475,12317995066059208800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1292
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:5624
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5644
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:5668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\594324687199_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3904
- - C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5812
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4888
- C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 892
    3⤵
    - Program crash
    PID:1272
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:5292
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5300
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:3424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\594324687199_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:5596

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6052 -ip 6052
1⤵
PID:5648

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ae626d9a72417b14570daa8fcd5d34a4

SHA1
c103ebaf4d760df722d620df87e6f07c0486439f

SHA256
52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

SHA512
a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c3ea95e17becd26086dd59ba83b8e84

SHA1
7943b2a84dcf26240afc77459ffaaf269bfef29f

SHA256
a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc

SHA512
64c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c65e704fc47bc3d9d2c45a244bb74d76

SHA1
3e7917feebea866e0909e089e0b976b4a0947a6e

SHA256
2e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110

SHA512
36c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
c50f423ca7051dd1be398c7c89cfab20

SHA1
c6e82a6dcdd0a89c84a0fdbcd59fcfbbcb267d24

SHA256
f91fe284b16a9068e1896dc93aadc5d7ada2f609eecc51453c511c4c0da6bf75

SHA512
afc6feff439da0466187c611b09e959a2b0ece8a3d534c8aecfb63c9834912397f2196cf486ca5bc2d0026329ea0944308712b2359c7c5f15c0635d801c846bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
21d486b4c743d7dc688ac7025240298d

SHA1
ee2a9f77a8e90f657b373a8353237a24064bec26

SHA256
51b78f3d1051c4e1a8270eb7e8d8b00bbb0374985a25022cfb32d16b0cb7da1b

SHA512
2b6bf92d6aabb79e12331993b4b07858205b36d6b99347c7b2ffb5edfc79bab649115d5c2c4aec4d9c42795bc7f41e1b10edd22e76a63e99fd6f06efe6ac6ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8c5c0c25339cbf46683a3ae880453ef8

SHA1
5007c761bd424b1d469bc4db17198390742f7e27

SHA256
1231de66675eac6993f56f16cc842b053957bb79e28c647743d258a869d9b46e

SHA512
472400cf285fcc7678eaec9e2735a5598e8220cc51e9730d431ac18d5ff59d827cc37bacfb90e0a9856c4a516b5064c0c2ee464b1678224b8bc664064a5c5798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bb100618ff699f64372cdf578e9e76d3

SHA1
a3bf3a8a0a307d27529eea6571606567cab77edf

SHA256
d1e14f4c568e0b8514748707beaf473527799d433ff14915c9103dd9b7bbdd3a

SHA512
d9fcc716cdca5828fb960a9907854891ba6d8e2f0d343d76bab0bed87952aa0279f6680b23cbd6da566bb1b91345b78f03c6971cb37a6aa0301cd7b3592cc693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f2730000fd925150a60d39de2924181

SHA1
204e3d0db6a372f7927d2a06479479fadd7383eb

SHA256
ba0f15f480a4632f0b379be2497becf41c7ec5061d0c76c6292aca843fe8de36

SHA512
65de3ff8b595b869fd9c2faf2b4f735fbb92dce40d4021bbf478afa1334efe3d87379683107a8c59856d2efb04826e4c259d2c632e78c07b54b3ad2912b80b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7fb65ce2d061642206e6ee4307df4efb

SHA1
e1ab5a59a727cdb8e503b4ca07191ad051fe40d8

SHA256
435b48f590360144fe4391c1be6f6ca0bf609fdf70996b50fc908ccc6a55d45b

SHA512
58587948f5b7321fef64c56d01a08f8d549674c6a55ebcbdc968b79e127d82d5b6b6d976427725bfb9ed54163029118c25cbf13d4277766118fbfe5f0db7130e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
b1799c030744114f61f3503001472ed7

SHA1
ab13f76a6efa21da21ac5bff6dc00a040e3bdc4a

SHA256
2d01718674be847c0e7adb6c349c82d3db24669276c2520417a39270cb51d8d1

SHA512
98d1e20e859fc6b441b14d520921194e75a2936f5483b675d840303c43f18823aefff33fb7417579f5b09f58428396330c3565afdc93f690ec65fdc2655360e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
12ecc419cab584aa2a4ebcca08ef206f

SHA1
9a6aa990f497de1f53d209d95f792fe47786a361

SHA256
c6a3463622fec3e32f7985f445173870236dd678fda3757463d00443926919af

SHA512
fa98f1e80a9927464331479cbb60efe19871a5f7f3e508826f22984435d0f4ef7ed9dae2c514f012a2b4cba99f385858914df85d0e3f4680e377fa0134799509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
c9014e9ab0d9b35f88265b81243db2aa

SHA1
c9e1233c3e2e01a2a8d023e84366a281edef4dc6

SHA256
178a3ab29d1152a5db0122c51d8d8edc8ecf703dc5f515fd8c95d12ebe6623dd

SHA512
a766d4597f5d9435ef2184ccecdac8df8a16f788f512792eb6df956a86d1943cf72829a772c51ba4faa049179dbe85859341c7e03edd2ffeeaa21bb6d1be83d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
75c57b9bd236d44379750c01ea065e3d

SHA1
f525949a50d08214c1ff4d25cfa25644bb4b9ade

SHA256
7da164b183b5fcc724070c977b2d633979ba30366656b7980c1c9217d1d9c1fc

SHA512
3c71ba332f6cd34d0a3ce73398101a9cc65d9bc8885ab4b2b1e383cfeebd5ef5e5c66b0d8b96bc0232bc357fcc1cdb45562dbe73666bf56754d26b6365c700d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58076d.TMP

Filesize
707B

MD5
633b8d88d184de00719cf511055e07a9

SHA1
5f1f98e127ca7c8eccae91d0d5c667a20337e5b9

SHA256
34caf30fa3e802e25732b98e0aed49b24ebb54e3a7a462ffe774b6c8813ac26d

SHA512
b2bd7f1d1c47bcb0a9e48086fe7ddfca04ed5554a8ec9f6feee2a511f2caa8be4f70dc496f93eeebe16cb282b675e06aa11d1f99fb71845e3b3a33eadb82c36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
06bbdc2aa93c64f5a9a403f56383fa83

SHA1
feefbde0b2bcd93b6ebb9cd67a679bca2afdb819

SHA256
2a8660585548da0516ac26fef2ec39c8de1463dab12fd112286a21274aea16e0

SHA512
7b620a58605893033da6f04713fcec14bb51c9a8a3f3f09b9905cb9df5f281b1ecbc1275cd99a45d227e573aed5d79f70135c67f169f95f61cf4aff5d9663f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ebe639af85d0310e9ed51855c23a7c21

SHA1
938708f3b49629d55da238e66a03cbed91ebc94d

SHA256
5c4f6636da508d138c4a1a8e068e7104503b118e9881f1cf00172f6f86dfb22d

SHA512
b97a1e6e6a96817f47b83d65d9236a9ef6f753f81dd62a64653d6ceba0650f935a9592abcaf11778a04515614b785b49195dcdd566147eb55f5d88535941579f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55103380eac3ee2ee956cd806cff1848

SHA1
26df8ff6eccccc056f8a7e737f873857dfe04aff

SHA256
22d6a346074295d22c295fc7964a5328568e73340feb3b2d3ac4c4fbad2ea459

SHA512
256e87e70fce3307f957dcc22db6afd54f88af48076af82fa97220ca3a8865a3d89a0e0165455ba4192dd9a18bf8f32a2855901dd37c9d237cb4b0adb801d801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1491745d3feac80841db6780604b0950

SHA1
3fbb9f62b447e57e8c1f168f29e53e4a3a2b9fd8

SHA256
a789ac4e94ecb67cf618835a48c886e6ab5186fcb3d1ee7e99cf10abd4d76bae

SHA512
f25453d68d43dccef88e843dcdf2e71d9059dcfca73b82c58552b4fe5aff5f95612163f32d9f54e0767573acf536c31029d5b7ddb0793abe25e94f02c4ac5d4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
758539f0ec156b50f60a09603b348502

SHA1
c4a899cf0f81b5e6e08a158d8ef65a904bd68915

SHA256
d20526ef8743cd431eaeaf02fdd3e760fd793691c2fb2ca98c1ae221d8364692

SHA512
9bd0f384b405ee2020fa50540ba8c198494d6b68251fc61d89cea8a3aa760421625c5332123b5d555c18a52992961784add32a0df22a8c30733a650c000ab67c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
117f100b470fab5df2196c1e8ea80f92

SHA1
06b6130a54c913085c362b41d217e725dc04a9a6

SHA256
96f2e1cab4f3e1048ebdf968222f60230586c576b1194cdfa0c19a510d9ae11c

SHA512
d53f599597da45f64de6426f9349d9713fcd8cbfdc6c25599ca1d280af81d867c338e88d172f3840ef130f62484f559b219fee46f41e955c417d5268bb383eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

Filesize
1.8MB

MD5
adde558172b7f7c3a4276c54cbe4483b

SHA1
96f0184995d56f17f884ab1515ef431ce34b6290

SHA256
c43450c5d5270511c285582f247fd7596f03b0b4c007b62b7b128d322f0f4921

SHA512
2aa8ac899b25dbde5bfc2fcbc5ec096a2403d144d9221f71654efcad6db3924b81bc55923888a062e554e254c7a3a101b27b285a933847eafb1099446f4ce5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\4b8aac482b.exe

Filesize
3.0MB

MD5
92733cca900e52750050ca992e0bc309

SHA1
eedcce9de85c093bb5ba58a0738e5eb831afb820

SHA256
2301d8437982049dc739d9ff9e8905942e0921ab717cf8e49d8327f9572d5c9d

SHA512
3ad3b4a8e97541976e20c4135b371b8db10ae63979f0159a9fa57e45f6f0231d5ccd6282c497ee577a234b39acc26a9d4cc749685dc91b48e7f80ec489acf402

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe

Filesize
894KB

MD5
2f8912af892c160c1c24c9f38a60c1ab

SHA1
d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

SHA256
59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

SHA512
0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe

Filesize
1.8MB

MD5
84fb0656d2462e97ad88d17212bdf2bc

SHA1
3f7caf3955ff8ebe0fe6c361a61b19971c693fd2

SHA256
a3170754eb777ef38d5dd3317ccd766ea1bca03a6e8d445ea26a75c5d68b747b

SHA512
3f798c2155a36a84fbb24331704947eec5f7c87e5a52967ef6462486aa41caab24c88889f62e1cdec2ed798c79936593ae7a92c14dce41d03582c885393296ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe

Filesize
321KB

MD5
1c7d0f34bb1d85b5d2c01367cc8f62ef

SHA1
33aedadb5361f1646cffd68791d72ba5f1424114

SHA256
e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

SHA512
53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

Download Submit
C:\Users\Admin\AppData\Local\Temp\594324687199_Desktop.zip

Filesize
177KB

MD5
89536108bf2e6235f6b5569f4beabe0e

SHA1
79f55cd1287b88e998f1ef530931d183b672032b

SHA256
bbfdcf2badc57cf259be2d6d0fbde1bbe3874baf7700e529c6e40c0a9f507a5f

SHA512
cbde62170fc5079fafb3ac290ff47a4bbf2b43ba35226520b82d5b5ca636d48dbcae0d49b05315153a81ed8a41b8d6b9f19c888838a2dd55b2973539ded5547a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Files_\SplitConvertFrom.xlsx

Filesize
177KB

MD5
8bd623f31c41f87df5097b9af346787b

SHA1
e442100355306b40ceee10b9f33cc0145da71b71

SHA256
e6dbdb9b884e99cfdfb9d37870ff63d4d5072693b43799bfccc7ea31223ca19f

SHA512
591a5c6f696c033bb5463241cee871a2ae37b298c92ff25ae49a944a6fe0bab324a71ee40929b6609d1729e63028d96c08d75644b83697bf0f4f063f308b9f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4wap10aj.eq1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
1.2MB

MD5
92fbdfccf6a63acef2743631d16652a7

SHA1
971968b1378dd89d59d7f84bf92f16fc68664506

SHA256
b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

SHA512
b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
109KB

MD5
726cd06231883a159ec1ce28dd538699

SHA1
404897e6a133d255ad5a9c26ac6414d7134285a2

SHA256
12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

SHA512
9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.2MB

MD5
15a42d3e4579da615a384c717ab2109b

SHA1
22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

SHA256
3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

SHA512
1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

Download Submit
memory/2968-31-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/2968-25-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-433-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-315-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-810-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-807-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-28-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/2968-793-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-781-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-778-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-775-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-326-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-26-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/2968-397-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-30-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/2968-29-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/2968-730-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-377-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-27-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/2968-298-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-763-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-688-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-431-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-32-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/2968-24-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/2968-33-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/3220-3-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/3220-23-0x00000000001C0000-0x0000000000681000-memory.dmp

Filesize
4.8MB

Download
memory/3220-11-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3220-10-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/3220-6-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/3220-0-0x00000000001C0000-0x0000000000681000-memory.dmp

Filesize
4.8MB

Download
memory/3220-5-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/3220-4-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/3220-9-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/3220-8-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/3220-2-0x00000000001C0000-0x0000000000681000-memory.dmp

Filesize
4.8MB

Download
memory/3220-7-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/3220-1-0x0000000077166000-0x0000000077168000-memory.dmp

Filesize
8KB

Download
memory/3884-359-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-360-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-430-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-396-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-54-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-743-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-339-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-706-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-774-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-432-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-52-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-777-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-821-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-780-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-809-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-484-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-804-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3884-792-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

Filesize
3.7MB

Download
memory/3904-353-0x00007FFFBFD10000-0x00007FFFC07D2000-memory.dmp

Filesize
10.8MB

Download
memory/3904-336-0x00007FFFBFD10000-0x00007FFFC07D2000-memory.dmp

Filesize
10.8MB

Download
memory/3904-337-0x000001C312070000-0x000001C312080000-memory.dmp

Filesize
64KB

Download
memory/3904-338-0x000001C312070000-0x000001C312080000-memory.dmp

Filesize
64KB

Download
memory/3904-347-0x000001C3120E0000-0x000001C3120F2000-memory.dmp

Filesize
72KB

Download
memory/3904-335-0x000001C312030000-0x000001C312052000-memory.dmp

Filesize
136KB

Download
memory/3904-348-0x000001C3120C0000-0x000001C3120CA000-memory.dmp

Filesize
40KB

Download
memory/4888-808-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-776-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-452-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/4888-820-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-451-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/4888-803-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-783-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-690-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-450-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/4888-779-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-448-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/4888-447-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/4888-449-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/4888-463-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/4888-731-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-462-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/4888-446-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-445-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/4888-764-0x0000000000280000-0x0000000000741000-memory.dmp

Filesize
4.8MB

Download
memory/5480-791-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/5812-346-0x0000000000220000-0x00000000006E1000-memory.dmp

Filesize
4.8MB

Download
memory/5812-342-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/5812-324-0x0000000000220000-0x00000000006E1000-memory.dmp

Filesize
4.8MB

Download
memory/5812-341-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/5812-314-0x0000000000220000-0x00000000006E1000-memory.dmp

Filesize
4.8MB

Download
memory/5812-323-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/5812-316-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/5812-317-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/5812-320-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/5812-318-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/5812-319-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/5876-459-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/5876-461-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/5876-464-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/5876-460-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/5876-458-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/5876-457-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/5876-456-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/5876-455-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/5876-454-0x0000000000C70000-0x0000000001131000-memory.dmp

Filesize
4.8MB

Download
memory/6024-489-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/6024-492-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/6052-485-0x00000000001B0000-0x0000000000202000-memory.dmp

Filesize
328KB

Download