amadey | 83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
03/04/2024, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
Size 1.8MB
Sample240403-ancbssaa7v
SHA256 83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4
MD5 77d0e9da4cfb0082407f1a74f2ce93e4
SHA1 3317d2c2da2238120f51d13ffce9bcd48f1a662d
SHA512 12879705c52939157dbb9719cb497c8f52deed6c6886e84813443d0fbeca704b37a72579d62bee72cb4f08f29b42663ed4bffb732eb42af6a7961679b96fc93f
SSDEEP 49152:aUGK0tP9gfgAoC/mdKQYNgG8JQFQ04Vv4OnAGyY3:9YTC/mfMkLVv4KAG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	be1640d9c6.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
43	1036	rundll32.exe
55	4068	rundll32.exe
60	1612	rundll32.exe
61	1540	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	be1640d9c6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	be1640d9c6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe

Executes dropped EXE 7 IoCs

pid	Process
4180	explorha.exe
3952	be1640d9c6.exe
2612	go.exe
5852	amert.exe
3284	explorgu.exe
2420	explorha.exe
3088	explorha.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
Key opened	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine	be1640d9c6.exe

Loads dropped DLL 6 IoCs

pid	Process
1316	rundll32.exe
1036	rundll32.exe
4068	rundll32.exe
4520	rundll32.exe
1612	rundll32.exe
1540	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Windows\CurrentVersion\Run\be1640d9c6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042001\\be1640d9c6.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe"	explorha.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025c7e-61.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2744	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
4180	explorha.exe
5852	amert.exe
3284	explorgu.exe
2420	explorha.exe
3088	explorha.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorha.job	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
File created	C:\Windows\Tasks\explorgu.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2744	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
2744	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
4180	explorha.exe
4180	explorha.exe
2152	msedge.exe
2152	msedge.exe
488	msedge.exe
488	msedge.exe
3032	msedge.exe
3032	msedge.exe
3732	msedge.exe
3732	msedge.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
5964	powershell.exe
5964	powershell.exe
5964	powershell.exe
5852	amert.exe
5852	amert.exe
5812	identity_helper.exe
5812	identity_helper.exe
4724	msedge.exe
4724	msedge.exe
3284	explorgu.exe
3284	explorgu.exe
2420	explorha.exe
2420	explorha.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
960	powershell.exe
960	powershell.exe
960	powershell.exe
3088	explorha.exe
3088	explorha.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
2744	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
2612	go.exe
2612	go.exe
2612	go.exe
2612	go.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
5852	amert.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2612	go.exe
2612	go.exe
2612	go.exe
2612	go.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4180	2744	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe	80
PID 2744 wrote to memory of 4180	2744	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe	80
PID 2744 wrote to memory of 4180	2744	83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe	80
PID 4180 wrote to memory of 3952	4180	explorha.exe	81
PID 4180 wrote to memory of 3952	4180	explorha.exe	81
PID 4180 wrote to memory of 3952	4180	explorha.exe	81
PID 4180 wrote to memory of 1376	4180	explorha.exe	82
PID 4180 wrote to memory of 1376	4180	explorha.exe	82
PID 4180 wrote to memory of 1376	4180	explorha.exe	82
PID 4180 wrote to memory of 2612	4180	explorha.exe	83
PID 4180 wrote to memory of 2612	4180	explorha.exe	83
PID 4180 wrote to memory of 2612	4180	explorha.exe	83
PID 2612 wrote to memory of 1892	2612	go.exe	84
PID 2612 wrote to memory of 1892	2612	go.exe	84
PID 1892 wrote to memory of 5020	1892	msedge.exe	87
PID 1892 wrote to memory of 5020	1892	msedge.exe	87
PID 2612 wrote to memory of 3032	2612	go.exe	88
PID 2612 wrote to memory of 3032	2612	go.exe	88
PID 3032 wrote to memory of 3000	3032	msedge.exe	89
PID 3032 wrote to memory of 3000	3032	msedge.exe	89
PID 2612 wrote to memory of 72	2612	go.exe	90
PID 2612 wrote to memory of 72	2612	go.exe	90
PID 72 wrote to memory of 576	72	msedge.exe	91
PID 72 wrote to memory of 576	72	msedge.exe	91
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92
PID 1892 wrote to memory of 2544	1892	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe
"C:\Users\Admin\AppData\Local\Temp\83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\1000042001\be1640d9c6.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\be1640d9c6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
    "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff748d3cb8,0x7fff748d3cc8,0x7fff748d3cd8
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,17065231611985721420,12275031668605560031,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
        5⤵
        
        PID:2544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,17065231611985721420,12275031668605560031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff748d3cb8,0x7fff748d3cc8,0x7fff748d3cd8
        5⤵
        
        PID:3000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
        5⤵
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:3052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        5⤵
        
        PID:3556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
        5⤵
        
        PID:1064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
        5⤵
        
        PID:2772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
        5⤵
        
        PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
        5⤵
        
        PID:3088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        
        PID:5684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
        5⤵
        
        PID:1600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
        5⤵
        
        PID:2804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9547252117665878839,13176408069105982922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1016 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:72
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff748d3cb8,0x7fff748d3cc8,0x7fff748d3cd8
        5⤵
        
        PID:576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,11414579222344975114,7056937381678792650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3732
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1316
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1036
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:5228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\472529282816_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5964
- - C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:5852
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3284
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:4520
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1612
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:5676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\472529282816_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:960
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1540

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2420

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a
MD5 ae626d9a72417b14570daa8fcd5d34a4
SHA1 c103ebaf4d760df722d620df87e6f07c0486439f
SHA512 a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3
MD5 ce319bd3ed3c89069337a6292042bbe0
SHA1 7e058bce90e1940293044abffe993adf67d8d888
SHA512 d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0
MD5 12b71c4e45a845b5f29a54abb695e302
SHA1 8699ca2c717839c385f13fb26d111e57a9e61d6f
SHA512 09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 72d50d3f209987179ade2c2cfe8248a3c99330ce5b848243fb5687670caaa33d
MD5 f7bae56c3ad8a5598e95b9127baf500f
SHA1 123655918f1bce74684679069cc9b6b4d918a199
SHA512 cc7421a67e31f2f0131c973c3e99e951c9b372e16656892fa90759d6ab510e63f1d87e4cec1c18e7e6e98010f8d32ecf586fddaf8baa6fbce5693ca6fd6b694e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9f0ea86b4a36fc7781a179932ad1e0e022fd82c1ff615ebb911d9bf8494de82c
MD5 0b472f82d4a1132cbe72e362eb33762a
SHA1 377dbbd586d846dde67ac95f6b5ac3fb4e5055db
SHA512 09c6f6443453add9b774339c83ee5a6771b633db9e906add088f26922445c16fc1ccf93721e983f41b14ce258e33e63cc6e9f6f9424e31d1eb698b30db7bf3e1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 acdb6fcaf0a3363e4f45042651069adfaabc71443461b2777ab285b989b73aaa
MD5 dc1abc928fb4f32ef7cb515c3aefc2b4
SHA1 d3c2ea84f4e98a31e25e40d4c6f7e91beee3f0f8
SHA512 1eb2504da7ce89821e23f095cb3f75eb4acce439c9fc8cd4bddee02727bf16ca0e2feacf4c365be3e45fc7a8f85487ea912a69288d32f45102580167e55a4273
SSDEEP 192:nvk3VHhkF1lAGK0Myughu+tuehI1TC0gpLe93:nveVHhkFG05Rhy1TBoC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 53268a6000b247a40f90556e50ade2f7185d4fbe19d4e7b74aaa9fdf31830c96
MD5 0492a7ef4e366f9855ceb5df05097ccf
SHA1 2b3eb66ed50567ee5b06f673905d5c215436ec58
SHA512 92230b1342789077cd18d4a8b2cd88f46f89c41e8b2c801fdfc33604d699e2fb3a11f5f2222336988a498235fddc727092375b37bfb6aed4112c9f675a3fd3f3
SSDEEP 96:nvk3V4doUkDuYkwSv0MoiVmdHI15JC0gh0WQyV+VpziX3wI3:nvk3V+hkS1v0MAI1LC0ghLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4e6d37bd4cd6cdd3884e3868fb88c33afab79846703122b880c51649c86274a6
MD5 b0f96f6f37699f50a751d1563b82c837
SHA1 216b61f8e7973563a4a8a85d30afb9643b63bc4d
SHA512 5e44bab1d7277d2b3dd4a86ce1cbc10210b85cad898d57e71b0aa5adf42f08e3884cc86bf956a8a37c0f466c9c6888cf001e9b7557cfb99017c5888b831f1c98
SSDEEP 192:nvk3VNhkF1lAGK0Myughu+tuehI10C0gpLe93:nveVNhkFG05Rhy10BoC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 bc007bdb2ea993b8136a58a95cb3da323ec44e2abb8b3e1686f8f69e46f8f8ec
MD5 98d0bf8798c335eb1d245b6fadbd8c43
SHA1 6dc444cbfd18939e645d09f1cc46b12c9a90ae0b
SHA512 964109410b74843abd1c6df86e710724168bce6fcc8bda49fad5005eccfcddee671ac404942496385feb67c6c64a0e5380c0c2df8407a785b46f91b027112bc8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 703B
SHA256 ae54085a50032a288dbf18cdee69ad3eeeb79e07ae07e4cafdbcf1311b1cb86e
MD5 6cf1d9bdb5601668ebac5927445ba208
SHA1 fa285081b316fb84b903ce3b479e06c2edf2b670
SHA512 de3f195a6cd9f3eba41d164507387d77385bc60d9e7d044f17868551a302dc204e06157b3de572608c3e0f290d1ff425139591d47050e4a1e8d90a7de6960972
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 322538067b734f256177c3b5396b3714ae7f938701eb3af39e587297ef9bc215
MD5 bf7d51d6bed6f217f1918d15c99ca55c
SHA1 2a2bd5f30b21b780a1f023fc3ebde23bd13e3fb8
SHA512 7f18cc5327fe960662b5b64c505ed7c8482f09bc83230cbe82bbcee37a947caaf30d91480f4055b25bd94e84c317bded4d5e9ec63d1a0e511442db3e9bf01eda
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 58ec6197d5371b27fbb61eccde9f450d74fd2811d9c0b46939574de741f854e4
MD5 389337d4250334efd57365a6605164a6
SHA1 16e77d9b16eecebbb64937d866fa8e9ad4cead1f
SHA512 4178e8fba159551eaa9f5de2b28df8064b576c94a5508c2b9a08d80b9f704434fc9dfa8ff1ed6e25720b9c430f712673f4226800b5bd2c9c9dfc502e77d558b9
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58337f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58337f.TMP
Size 707B
SHA256 60b7922c90319a7209dea348fbb7cb835e6a10bf290112a20fd84ccf420c0462
MD5 ddceead00f28224445d49275b5777c83
SHA1 72c580a58ff8793752ad29a93d8e18288da82ec6
SHA512 358d6cb4d00306634cf89cb6f26c060c90f1afa737db6e080208a5f89aca9fd61ff45897dcfd63f2df64ddb32d7240b726027e86ded17e5a642ad534d33a7cad
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 342f09a6e9306b402f265574a72995eb93bda3570946e4cfcd02d03ddf2649d4
MD5 a0ce3b7492bed85c4fe89022e6fc6cd6
SHA1 340a4baf5b180d5888b090bc02e11ea0a618c65a
SHA512 088c7c52e3f06f05232e9f0302720e37d6c4a35efec017204216795006539e855751f02602fe8a090a1b0cc2ef8f68f222c719ecabf2b29ad0ab67fac65be249
SSDEEP 192:UoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGt43e2RUy4R6g7PjXYYq:09iIxuERzA83h09RZxASG+/NxYjXYYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 726f9c8ee68e66a2b195ebedd772817f7fd0059b2c1b4f8b1826936eba408cb5
MD5 1a941848d23db0cbeacacc3b088c53e2
SHA1 ce12d8360de5d724bc26d7161bdfc2f7e5db4f27
SHA512 6104696401e7e5e5b9aa83f14031ccce6070b02d0c788f3653f1631bf057714a02e0f2ee87d2e6ba11c709d994da6a3c8c73283214f7802e96dc3de727bff6cc
SSDEEP 192:UoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGt42e2RUUq4R6g7PQXYYq:09iIxuERzA83h09RZxASG+YhqxYQXYYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a8a66ec73efcbc87e7e8b57c7ba2a97cf8052fb19c3003271360528da6d44171
MD5 e3ec5ada4e7e3792733614bdc6876b55
SHA1 95f2e2f86cc4326e8952687e98c7882f3385dcb1
SHA512 9ff2deda9b2feafeb0b4e8995922ec9ee17f5bc6928626742880f6fb4c2fd759b31c1f256025ebef7a072fa7931ea917019f2d37ac896089fa45a6f2a7f026e0
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGo40e2RULIj6g7P3zEtUaXIs7:M9iIxuERzA83h09RZxASGJ6O7Y3daX37
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a52a49d166d3cfcb8ed389b82136bea311495b54145db5d19f883fcfdabcb079
MD5 17505bb5378e201ec2d8a10aafb2851f
SHA1 3cc4c6a4f6135538ac5b014cc7decba8adcd5324
SHA512 85edfef28b1bb2cca2d95ba03bd59a418e20cdb0562abf91da394beafa844a9c954c7fa4005754fc36aceb3fa0371b04453923ecde7b418450defe7d867ae526
SSDEEP 192:yoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGo40e2RULIj6g7PvzEtUaXIs7:G9iIxuERzA83h09RZxASGJ6O7YvdaX37
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 96b78e90c4ed96366e807fdbc0e83b9a35d28157577040dd2e9556f976319951
MD5 bc2722c0412ec63225416a47c1ac8ef3
SHA1 2257802f9a7dc82ddc60e01f8fa54a736b048419
SHA512 3e61e690b94e2a22e605f624ff863585bff3fa25053cf97571caebc6aac79f92c33f0ce8390eac56ccfb40597ea03004a73ad5615be7f7d055673b35d7da4f2b
MD5 SHA1 SHA512

Submit Download

explorha.exe

Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Size 1.8MB
SHA256 83f588024113f2eeed101a9c69c3e405d35e2bf56ac5ff5f08003d3eff0a25e4
MD5 77d0e9da4cfb0082407f1a74f2ce93e4
SHA1 3317d2c2da2238120f51d13ffce9bcd48f1a662d
SHA512 12879705c52939157dbb9719cb497c8f52deed6c6886e84813443d0fbeca704b37a72579d62bee72cb4f08f29b42663ed4bffb732eb42af6a7961679b96fc93f
SSDEEP 49152:aUGK0tP9gfgAoC/mdKQYNgG8JQFQ04Vv4OnAGyY3:9YTC/mfMkLVv4KAG
MD5 SHA1 SHA512 SSDEEP

Submit Download

be1640d9c6.exe

Path C:\Users\Admin\AppData\Local\Temp\1000042001\be1640d9c6.exe
Size 3.1MB
SHA256 e0be60030608a7fbd0f1fba8088c7238c17c028bda6319f896219adcd8764285
MD5 021c780e1287e6764fbdc7127f9d4345
SHA1 a8339ed033b5769db2132b0c31e76292d6597768
SHA512 b212d25cf77f315a2b36b10f6290e44d4d951df4eb1dc09b8e6f320a161650456e2b47c5074804ad427e6adb7a56665ead80a320b6f7b97ddb111a1651ceb199
SSDEEP 49152:HOsE6QeD3k+aIIXRHWTLdf1tldajgfX+2MO5cnP+BzmuKJr:UperknIIXRHYdfpdajgfX+2MO8Pam3
MD5 SHA1 SHA512 SSDEEP

Submit Download

go.exe

Path C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
Size 894KB
SHA256 59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308
MD5 2f8912af892c160c1c24c9f38a60c1ab
SHA1 d2deae508e262444a8f15c29ebcc7ebbe08a3fdb
SHA512 0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb
SSDEEP 12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TN:qqDEvCTbMWu7rQYlBQcBiT6rprG8aAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

amert.exe

Path C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
Size 1.8MB
SHA256 56c7b5e570707363aa5ea06d2faa9e7a250a87f829120e0dbb49d959f684e51d
MD5 a47dde966ef4e669e55120c133d32909
SHA1 e61830b3bd5777bc3856248e7aac66347959aefa
SHA512 a1d099d768fa03a06284bd4b9f6604efa7ba118ba87852b072d97c2f262def6511de56a051dc6952c87261b7d9c378f2f5b11d095f21fe956406086868f33f62
SSDEEP 49152:JiKmkRI1YE9aNmCYLIWfaZ/H8bh2WI01dx7ccSk:JpRRI2E9EMINO5dxBSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_nmfawlsi.cla.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nmfawlsi.cla.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 109KB
SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
MD5 2afdbe3b99a4736083066a13e4b5d11a
SHA1 4d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA512 d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
SSDEEP 3072:xE5kJp+s5aP40bGsuZR+SVhJQ3ICRv4l:m5ka2obfuZR7Py4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 1.2MB
SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
MD5 92fbdfccf6a63acef2743631d16652a7
SHA1 971968b1378dd89d59d7f84bf92f16fc68664506
SHA512 b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
SSDEEP 24576:ZvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dgg/l+yC7:ZsMPSYcS5wPi095PbgWl
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 109KB
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
SSDEEP 3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 1.2MB
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
SSDEEP 24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2420-441-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/2420-431-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/2420-442-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/2420-445-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download

memory/2420-440-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/2420-447-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/2420-449-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/2420-443-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/2420-444-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/2744-7-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/2744-1-0x0000000077736000-0x0000000077738000-memory.dmp

Download

memory/2744-8-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/2744-10-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download

memory/2744-0-0x0000000001000000-0x00000000014B6000-memory.dmp

Download

memory/2744-5-0x0000000005540000-0x0000000005541000-memory.dmp

Download

memory/2744-6-0x0000000005590000-0x0000000005591000-memory.dmp

Download

memory/2744-2-0x0000000001000000-0x00000000014B6000-memory.dmp

Download

memory/2744-11-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/2744-23-0x0000000001000000-0x00000000014B6000-memory.dmp

Download

memory/2744-3-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/2744-4-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/2744-9-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/3088-571-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/3284-446-0x0000000004E70000-0x0000000004E71000-memory.dmp

Download

memory/3284-559-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-452-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-577-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-437-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/3284-438-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/3284-439-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/3284-436-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download

memory/3284-432-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-435-0x0000000004E10000-0x0000000004E11000-memory.dmp

Download

memory/3284-589-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-434-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download

memory/3284-594-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-487-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-433-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/3284-574-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-429-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-515-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-524-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3284-562-0x0000000001000000-0x00000000014C8000-memory.dmp

Download

memory/3952-513-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-575-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-557-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-217-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-394-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-393-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-595-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-522-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-334-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-560-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-53-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-592-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-572-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-466-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-450-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-578-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-402-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/3952-52-0x0000000000CF0000-0x00000000010B0000-memory.dmp

Download

memory/4180-573-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-561-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-33-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/4180-29-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/4180-32-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/4180-451-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-287-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-249-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-588-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-31-0x0000000004B70000-0x0000000004B71000-memory.dmp

Download

memory/4180-593-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-486-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-56-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-576-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-28-0x0000000004B80000-0x0000000004B81000-memory.dmp

Download

memory/4180-30-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/4180-514-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-220-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-24-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-523-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-401-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-25-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-26-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/4180-27-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/4180-428-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/4180-558-0x0000000000B40000-0x0000000000FF6000-memory.dmp

Download

memory/5852-315-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/5852-313-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/5852-371-0x00000000007E0000-0x0000000000CA8000-memory.dmp

Download

memory/5852-338-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/5852-336-0x0000000005340000-0x0000000005341000-memory.dmp

Download

memory/5852-316-0x00000000052B0000-0x00000000052B1000-memory.dmp

Download

memory/5852-300-0x00000000007E0000-0x0000000000CA8000-memory.dmp

Download

memory/5852-302-0x00000000007E0000-0x0000000000CA8000-memory.dmp

Download

memory/5852-304-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/5852-318-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/5852-317-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/5964-254-0x0000023AF5890000-0x0000023AF58A0000-memory.dmp

Download

memory/5964-301-0x0000023AF5B70000-0x0000023AF5B82000-memory.dmp

Download

memory/5964-303-0x0000023AF5B50000-0x0000023AF5B5A000-memory.dmp

Download

memory/5964-232-0x0000023AF56A0000-0x0000023AF56C2000-memory.dmp

Download

memory/5964-335-0x00007FFF611F0000-0x00007FFF61CB2000-memory.dmp

Download

memory/5964-238-0x0000023AF5890000-0x0000023AF58A0000-memory.dmp

Download

memory/5964-237-0x0000023AF5890000-0x0000023AF58A0000-memory.dmp

Download

memory/5964-236-0x00007FFF611F0000-0x00007FFF61CB2000-memory.dmp

Download