amadey | 97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8

Analysis

max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240319-en
resource tags

arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
submitted
31-03-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
Size

1.8MB
MD5

36cdd421bca18b892a7b9acbf8ddae22
SHA1

7304ee9320fa859d3996603621722b5b4d1af44b
SHA256

97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8
SHA512

db73b4c5fe2cab6220122969594215a292950ccaa028887bfc8d3dd6de8c83d0e0c0495e81250ee33d3e3c718bae663d0eb5aa954cb4b8545b08c32d2cc97855
SSDEEP

49152:pEWkwR/hFIzWw0/Xi7Wk7wMbf3fdSnnC2Z6mte:SWBIK7/XAwznea

Score

10^/10

amadey risepro evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	732f401184.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
43	5132	rundll32.exe
44	5828	rundll32.exe
49	5224	rundll32.exe
51	4052	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	732f401184.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	732f401184.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe

Executes dropped EXE 8 IoCs

pid	Process
4696	explorha.exe
4736	732f401184.exe
3812	explorha.exe
2496	go.exe
3388	amert.exe
492	explorha.exe
5528	explorgu.exe
5736	explorha.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	732f401184.exe
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Wine	explorha.exe

Loads dropped DLL 6 IoCs

pid	Process
3648	rundll32.exe
5132	rundll32.exe
5828	rundll32.exe
5364	rundll32.exe
5224	rundll32.exe
4052	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000\Software\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe"	explorha.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002a7da-64.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1584	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
4696	explorha.exe
3388	amert.exe
5528	explorgu.exe
492	explorha.exe
5736	explorha.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 3812	4696	explorha.exe	80

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	amert.exe
File created	C:\Windows\Tasks\explorha.job	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1584	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
1584	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
4696	explorha.exe
4696	explorha.exe
4640	msedge.exe
4640	msedge.exe
3388	amert.exe
3388	amert.exe
4932	msedge.exe
4932	msedge.exe
5036	msedge.exe
5036	msedge.exe
3928	msedge.exe
3928	msedge.exe
5132	rundll32.exe
5132	rundll32.exe
5132	rundll32.exe
5132	rundll32.exe
5132	rundll32.exe
5132	rundll32.exe
1212	msedge.exe
1212	msedge.exe
5132	rundll32.exe
5132	rundll32.exe
5132	rundll32.exe
5132	rundll32.exe
5224	powershell.exe
5224	powershell.exe
5224	powershell.exe
5904	identity_helper.exe
5904	identity_helper.exe
5528	explorgu.exe
5528	explorgu.exe
492	explorha.exe
492	explorha.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5224	rundll32.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe
5736	explorha.exe
5736	explorha.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5224	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
1584	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
2496	go.exe
2496	go.exe
2496	go.exe
2496	go.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2496	go.exe
2496	go.exe
2496	go.exe
2496	go.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4696	1584	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe	78
PID 1584 wrote to memory of 4696	1584	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe	78
PID 1584 wrote to memory of 4696	1584	97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe	78
PID 4696 wrote to memory of 4736	4696	explorha.exe	79
PID 4696 wrote to memory of 4736	4696	explorha.exe	79
PID 4696 wrote to memory of 4736	4696	explorha.exe	79
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 3812	4696	explorha.exe	80
PID 4696 wrote to memory of 2496	4696	explorha.exe	81
PID 4696 wrote to memory of 2496	4696	explorha.exe	81
PID 4696 wrote to memory of 2496	4696	explorha.exe	81
PID 2496 wrote to memory of 4932	2496	go.exe	82
PID 2496 wrote to memory of 4932	2496	go.exe	82
PID 4932 wrote to memory of 1604	4932	msedge.exe	85
PID 4932 wrote to memory of 1604	4932	msedge.exe	85
PID 2496 wrote to memory of 1852	2496	go.exe	86
PID 2496 wrote to memory of 1852	2496	go.exe	86
PID 1852 wrote to memory of 3524	1852	msedge.exe	87
PID 1852 wrote to memory of 3524	1852	msedge.exe	87
PID 2496 wrote to memory of 3172	2496	go.exe	88
PID 2496 wrote to memory of 3172	2496	go.exe	88
PID 3172 wrote to memory of 2744	3172	msedge.exe	89
PID 3172 wrote to memory of 2744	3172	msedge.exe	89
PID 4696 wrote to memory of 3388	4696	explorha.exe	113
PID 4696 wrote to memory of 3388	4696	explorha.exe	113
PID 4696 wrote to memory of 3388	4696	explorha.exe	113
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91
PID 4932 wrote to memory of 4908	4932	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe
"C:\Users\Admin\AppData\Local\Temp\97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\1000042001\732f401184.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\732f401184.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
    "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe09343cb8,0x7ffe09343cc8,0x7ffe09343cd8
        5⤵
        
        PID:1604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
        5⤵
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:3612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        
        PID:3556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
        5⤵
        
        PID:2000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
        5⤵
        
        PID:2824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
        5⤵
        
        PID:5760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
        5⤵
        
        PID:5420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
        5⤵
        
        PID:4648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14082104756316739446,10812374008825766225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5828 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe09343cb8,0x7ffe09343cc8,0x7ffe09343cd8
        5⤵
        
        PID:3524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,5735057386950862809,2184992927155688138,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2008 /prefetch:2
        5⤵
        
        PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,5735057386950862809,2184992927155688138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe09343cb8,0x7ffe09343cc8,0x7ffe09343cd8
        5⤵
        
        PID:2744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,9840078314789661682,10952002213038236632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3928
- - C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3388
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:3648
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5132
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:5264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\233663403127_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5224
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3388
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:5828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5528
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:5364
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5224
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:6032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\233663403127_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5900
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4052

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:492

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ae626d9a72417b14570daa8fcd5d34a4

SHA1
c103ebaf4d760df722d620df87e6f07c0486439f

SHA256
52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

SHA512
a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4113e45804b7888f88ae2a78482d0951

SHA1
4c59bba45c65ba65aa920cbd4eb0d7ccf517a220

SHA256
174195025b51f69ece21274cd7a97fff9f3d9a4bf57185ff3b1297bf2da6d1db

SHA512
16355c4c575a162396cf2ca377f586b3659a70e8c1708cad66b74bb3ef66cbf9ed33d9376730325d95420e5f4f558b2bdb6b5b7595b8b822eb6d2449a83c3f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e521eb4a4c2bbe4898150cf066ee0cb0

SHA1
c2b311b8b78c677b55a356b8274197fdcbae8ab5

SHA256
1f947cf3be3f525e3039b9c363bb7d7bc0dd2b70da434149e0f0cbbc5d13dbe3

SHA512
59e1b52a41dad2e7f36e0343e330b00bc33a7ba88f616928fd2b6cc526cac6effed76b006cb8a23ff45e85be27647114c7a8376ef3ba53d38ccb9ed4de9a5ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
5211c488df2fcc3c5a97673db2a20363

SHA1
506d70585229aa9ff16e11cdf23c22afd715d7d8

SHA256
84e433bc2a95297c92612a8c7e8f002d1e26a0b5387c1d1070198df67385f1a4

SHA512
69e08274dc4e9ceaea18c148bd6cec8a7d244a6dc30778529495cc07433c38671a3dded51df9e99f39d5e09bfe066e4ce499834a91a8c48bc4e741bea7c9de58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
791d81e2379f49d08a19aac47bd023b9

SHA1
9a3c27f688766a3ca46f5d37251db956e7bd78e8

SHA256
9247faa559a4b917cea4dc3d2da1335906c199dfe6879c4c84c64dcd6e1fb33a

SHA512
7f7505fd4f74ec60fb5bbe9a943aba4bb156134f1ee817019ef8c655c624183a0b9960657cef8b671b138a16cfc3f51685b6946d76fd184f4456b2870c364ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d0cec9887fa5da5ab72e1d9aa2b5e469

SHA1
8b550683c0be170fa2b6034ffb9c3bf516aed033

SHA256
e0046eb48366865a4b4147744cc76fdb5e64b1b1176103ea6373eae71942bcb4

SHA512
2c7ed1b11370e47f57b2d5830d8666c7d36408b80ed84ec1fd2cf6f4ec8d4b48e61a08f5fc6b96cec18d5027d77709d373a48b6821b9edc8154be6c631e01ca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5152cfd7c07750ef3098823cc7eaec6a

SHA1
9fbdc0c74026f64a7abb002b3c2027edca3bba27

SHA256
415d62fcf54d909e1928f785c8a85f27aa88651b607bfe6b391ced544e0f9a50

SHA512
9e83e4b0f49486a5ef0ee950c5a4bd3af5c00eb04b9d9a27b6312788de64ccf66546569556a6406b7fefe5dade33beb96cf08800fff13a51e977e64655f44cf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
64d2d350bb787641ccfeea12ce015a77

SHA1
088097603e2a92b15ad4e3dcdcf6028f1a8689de

SHA256
455a2c8bc864edaec8c3e79254b0cec2c2c2164a881089fcadd7ba06c3af0117

SHA512
bca8f68b76013b2fb9da58ac42bc79504903983454d470320881eafb00819fb2b35ac09a25aaaec7a88e07e7656b90469b6656f8e7982b3cfb4b007627f0f1c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
f06396860f93f370c7da8a39814897ae

SHA1
f91403100caf2716aece6fab117071fd681a80d1

SHA256
4f66159cbfde0a306060664e7cb729977ecea35e22303cd3fbdedfc4aa54f7fd

SHA512
119862634de9b4d42dde17dd1442f2d5eb08cec4a015bdc76882eb20ae623655ffdd02853c259d7a1f6edcc7c5da54a58d1ac3fe320d4cc5536d8a8007ea3db3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
9e36be4dd2d1676d3eb7ee5ebfecbf13

SHA1
71e15af2d74e6f49f960a007a6fd1f5b221cf5bb

SHA256
fe467f451e795285678ba8041a331ec33eae61319495adba99099603b664443b

SHA512
f242141bf1a2db8c92182a3d4cf3137cc3058c19c7843ef0efbf18b87ebd82d5414dc2b139ad4ae8dc1e6ad068d17829222fdabbdb32bcff3fa76ef4e31c75ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
8b04ce92568f5eaded8f9a6d9ff3d904

SHA1
ed312f447f117b04add5d84b7b4286989e5a554c

SHA256
7f83294599c718cc39a146684127e5462bb86830ed5b1372f2352bb2bc752258

SHA512
8028c3f5a7ebfc78633b05a7f286251a96457a9a0f09586f6b6c3d026a68a45cc9d32f25ab9ccd721873fdcd8ee5ad17b04e1da40f41ccbe9e4981b7fb3cb58d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58174c.TMP

Filesize
707B

MD5
4fa85bd73f561f210871cc82e61178f3

SHA1
065771c2faa69f159cfba4fa2ff30de4cd9b4294

SHA256
9a5e124d0df386bb4b2635e812036659dc718dd7955271763cd2d7a7feeb389e

SHA512
40e685c60ba55fc106bb1a50c6b01ddec088bf37db7a060ba281a9576429bdc9da15baedf29846ea261fad4130232d983e74d33db468aec3c87453b32d99c58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b6dbb5d8e02279e598ea2dbc653c0eb7

SHA1
2a996423380fc2e552d8b791b75e3d9b0360fc17

SHA256
be60ee58d3a96e4f83be386abe0fd3dbe6564fc69965340252c228560d271672

SHA512
d8c8fa1585cca97cffa9c21245fe372f6400d71578a23478985f8a486e98bfd3d9bc11e9813d959a60be2df03ebefb6dcca4e30a74507214758e4c54d1dd461d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f3a90f8798c6c029fd1e4af7354d242c

SHA1
cadb40ff0ce954315b5d389c964fdc63b6b21c5e

SHA256
090873b2fd2029957b8e79be7656ddcafe156d83e94b59ca08679c9a2b516749

SHA512
c7d79d3046f902fb5b80619daf7108b29c865ec2ebf13d1c9b21d0bc261b6a766b24f0b7c5d3ca70c14a0d76201817fcc96727c5534f6c1f9e16e300de74ede8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a986c70a3df646d31f1ab24a8844e0ce

SHA1
e57a8aa29dee409854fcf859d84c33c2b75d7d01

SHA256
e6bae422acee1e6074efde3c67e5eb4c38581abdf245400d8e95f8b967c2aaa2

SHA512
95202ed0e72621943924f25b811c4ef104e6653cb533ffc8624d1c7d5c42f77c748e174f3eec4abf121f004ccc2d03daaa88e0671fd0fc6365efdd6af610475a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0932998d5a243773ad18a3d06e026e9

SHA1
784a7dd478a6f6cccf4d57fdf2d4cd7ddb491b43

SHA256
794e106daced296217008a7ca26d4d9b9947e92ea8195e0f2e8d933fc3b8d3af

SHA512
b04ac1a2ada7d0a934af32568a1f23a84c8f5bce7f9b1639ad155f3a76186de279d4e8a7ea1ba5ba5cfb5f2e0ddd13aad339b0069846716c35abbc2b5a4645bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6eb87ec04ba72126401c4b92099db60

SHA1
b7eaffea8b5a2181b2d92f99fd6248c5b560bca5

SHA256
9cef2213792e8c1dd204719effa42998f0be59eee1adc7d1c02701f2a839d6fa

SHA512
5c6a6d45097bfd74bd665d9b926909cdcfe37b97ac4584eed6ccf7d3ad7e2527b413a39f69b7fd92cde93cd69e87ff6dc6beef357116e0fc378080d109be8862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7900980386a02c9040da96edac33c5df

SHA1
7381a37358d153a8da92d57a97aa177d2431680b

SHA256
cedd3a0d8738bd3bf62f434170a251a491f59d544ac93ba6c890ecc619d87482

SHA512
b9cb4c61cafb9b9644b66f086525e3ccb30eeea81ed561fa3f5455947bd26f149f6056eaa6b30af2327beee1955ad926eafcde09dc7ed71ce51974851212ba54

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

Filesize
1.8MB

MD5
36cdd421bca18b892a7b9acbf8ddae22

SHA1
7304ee9320fa859d3996603621722b5b4d1af44b

SHA256
97af1cd8f14c81dc532c69899d8f6efde30e3da17340d0a18cb785ac63eb58f8

SHA512
db73b4c5fe2cab6220122969594215a292950ccaa028887bfc8d3dd6de8c83d0e0c0495e81250ee33d3e3c718bae663d0eb5aa954cb4b8545b08c32d2cc97855

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\732f401184.exe

Filesize
3.0MB

MD5
b3425a798d6277a9587556adea55f68c

SHA1
9d0ecfc256fbd79d4e7d0c6e824116beca7a1aa1

SHA256
2fc02303dd25532f8e7d443446feb57237f2640a5969573162ed559b1fd43f1e

SHA512
d9d0dc9617463afa62e904fe75a534af9027d9b607e83f0ef335fb67fda81043432f40edb4d08b349c73c805fcc38a76b10a12f9e23ba5a8461c4d7b1abd7ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe

Filesize
894KB

MD5
2f8912af892c160c1c24c9f38a60c1ab

SHA1
d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

SHA256
59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

SHA512
0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe

Filesize
1.8MB

MD5
1740d8eed54ecd48552cd5386015e083

SHA1
7af4260beb295bdd1f61f3e7e3eaaff8128a84d8

SHA256
4d60abbde2be07c9d97b289adac1d02806c2da2bfe3c1fb8fcc8a0ed1be788f8

SHA512
66832c47e6445f14c139382a0a3de4e1764ce2f1c60ad550389d34e4c2defa307d82c799769fa00c2ddcc096bb33c8a5f6aa775e56367e1213827f52f9b6282a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvqlctwy.3i2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
1.2MB

MD5
92fbdfccf6a63acef2743631d16652a7

SHA1
971968b1378dd89d59d7f84bf92f16fc68664506

SHA256
b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

SHA512
b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
109KB

MD5
726cd06231883a159ec1ce28dd538699

SHA1
404897e6a133d255ad5a9c26ac6414d7134285a2

SHA256
12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

SHA512
9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.2MB

MD5
15a42d3e4579da615a384c717ab2109b

SHA1
22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

SHA256
3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

SHA512
1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

Download Submit
memory/492-445-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/492-446-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/492-447-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/492-444-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/492-443-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/492-448-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/492-425-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/492-452-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/1584-6-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1584-4-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/1584-0-0x0000000000AC0000-0x0000000000F6F000-memory.dmp

Filesize
4.7MB

Download
memory/1584-10-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/1584-8-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/1584-1-0x00000000778D6000-0x00000000778D8000-memory.dmp

Filesize
8KB

Download
memory/1584-7-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/1584-22-0x0000000000AC0000-0x0000000000F6F000-memory.dmp

Filesize
4.7MB

Download
memory/1584-2-0x0000000000AC0000-0x0000000000F6F000-memory.dmp

Filesize
4.7MB

Download
memory/1584-3-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1584-5-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/1584-9-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/3388-164-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/3388-171-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/3388-185-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/3388-205-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/3388-189-0x0000000000DC0000-0x000000000127B000-memory.dmp

Filesize
4.7MB

Download
memory/3388-187-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/3388-186-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/3388-184-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/3388-206-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/3388-223-0x0000000000DC0000-0x000000000127B000-memory.dmp

Filesize
4.7MB

Download
memory/3388-146-0x0000000000DC0000-0x000000000127B000-memory.dmp

Filesize
4.7MB

Download
memory/3388-177-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/3812-87-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-82-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-159-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-125-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-110-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-109-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-108-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-163-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-107-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-100-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-103-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-104-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-106-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-157-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-148-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-147-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-55-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-139-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-58-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/3812-101-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-102-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-99-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-81-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-89-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-90-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-59-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-88-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-68-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-79-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-80-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-435-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-86-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-83-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-84-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-424-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/3812-85-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/4696-525-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-138-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-23-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-614-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-423-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-24-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-593-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-26-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/4696-566-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-558-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-27-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/4696-545-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-25-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/4696-188-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-28-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/4696-29-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/4696-30-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/4696-31-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/4696-32-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/4696-476-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-366-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download
memory/4696-33-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4736-556-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-544-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-457-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-52-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-197-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-400-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-565-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-586-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-616-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-381-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-54-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-506-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/4736-613-0x0000000000A60000-0x0000000000E0D000-memory.dmp

Filesize
3.7MB

Download
memory/5224-398-0x000001E7C8B70000-0x000001E7C8CBF000-memory.dmp

Filesize
1.3MB

Download
memory/5224-392-0x000001E7B04E0000-0x000001E7B04EA000-memory.dmp

Filesize
40KB

Download
memory/5224-391-0x000001E7B04F0000-0x000001E7B0502000-memory.dmp

Filesize
72KB

Download
memory/5224-380-0x000001E7B0480000-0x000001E7B04A2000-memory.dmp

Filesize
136KB

Download
memory/5224-379-0x000001E7C8B60000-0x000001E7C8B70000-memory.dmp

Filesize
64KB

Download
memory/5224-390-0x000001E7C8B60000-0x000001E7C8B70000-memory.dmp

Filesize
64KB

Download
memory/5224-399-0x00007FFDF55B0000-0x00007FFDF6072000-memory.dmp

Filesize
10.8MB

Download
memory/5224-378-0x00007FFDF55B0000-0x00007FFDF6072000-memory.dmp

Filesize
10.8MB

Download
memory/5528-442-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/5528-438-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/5528-437-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/5528-546-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-585-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-436-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-426-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-564-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-594-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-477-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-526-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-439-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/5528-440-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/5528-615-0x0000000000B30000-0x0000000000FEB000-memory.dmp

Filesize
4.7MB

Download
memory/5528-441-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/5736-603-0x0000000000FA0000-0x000000000144F000-memory.dmp

Filesize
4.7MB

Download