hxxps://sites[.]google[.]com/view/wdawdawdqe23123/home

Analysis

max time kernel
1189s
max time network
1159s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17-07-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sites.google.com/view/wdawdawdqe23123/home

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
1	sites.google.com
2	sites.google.com
3	sites.google.com

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exeEXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000cf47663457c37365d92cb0d9805c3cc5478983cefbceda20d4997e29406506f2f77ec50cdcbd74cc275dd1d60b1980559b0bc2466bddd8de8e0e	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = ede695d54ed8da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8fd20dd04ed8da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "427993152"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
4120	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
5992	EXCEL.EXE

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	Process
3012	MicrosoftEdgeCP.exe
3012	MicrosoftEdgeCP.exe
3012	MicrosoftEdgeCP.exe
3012	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

MicrosoftEdgeCP.exefirefox.exe

description	pid	Process
Token: SeDebugPrivilege	852	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	852	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	852	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	852	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4736	firefox.exe
Token: SeDebugPrivilege	4736	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

firefox.exe

pid	Process
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

Processes:

firefox.exe

pid	Process
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exeEXCEL.EXE

pid	Process
520	MicrosoftEdge.exe
3012	MicrosoftEdgeCP.exe
852	MicrosoftEdgeCP.exe
3012	MicrosoftEdgeCP.exe
4736	firefox.exe
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE
5992	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MicrosoftEdgeCP.exefirefox.exefirefox.exe

description	pid	Process	procid_target
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 3012 wrote to memory of 2444	3012	MicrosoftEdgeCP.exe	78
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 2428 wrote to memory of 4736	2428	firefox.exe	85
PID 4736 wrote to memory of 4124	4736	firefox.exe	86
PID 4736 wrote to memory of 4124	4736	firefox.exe	86
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87
PID 4736 wrote to memory of 212	4736	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://sites.google.com/view/wdawdawdqe23123/home"
1⤵
PID:4496

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:520

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4668

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:852

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UnregisterOpen.cmd" "
1⤵
PID:4528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockMeasure.ps1xml
1⤵
- Opens file in notepad (likely ransom note)
PID:4120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.0.906453893\1432404422" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1704 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7d44857-09ea-45d8-935a-41d1ad9a2533} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 1796 19bab8d5d58 gpu
    3⤵
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.1.354745007\454414549" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {734f8be4-ca48-4ef9-a0eb-12f1f8896be1} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 2152 19bab732658 socket
    3⤵
    - Checks processor information in registry
    PID:212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.2.932991238\552959254" -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 2864 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0d32fed-6219-4705-8c54-934b50b2e6bd} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 2840 19bafe98758 tab
    3⤵
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.3.1641849741\2054806548" -childID 2 -isForBrowser -prefsHandle 3384 -prefMapHandle 3380 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d454929-efee-4d14-8bee-2b4ab2e8243d} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 3396 19b99862e58 tab
    3⤵
    PID:400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.4.4481263\75920391" -childID 3 -isForBrowser -prefsHandle 3832 -prefMapHandle 3828 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c87854d-ee0e-456d-b568-5b14ecea3fd7} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 3872 19bb110e858 tab
    3⤵
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.5.1417719126\1108983975" -childID 4 -isForBrowser -prefsHandle 4972 -prefMapHandle 4960 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69cda897-6b7f-465f-a086-9f35b1684464} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 4860 19bb231be58 tab
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.6.2142058746\976105742" -childID 5 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5681deb4-511a-4321-bfdd-851785de0251} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 4988 19b99863e58 tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.7.2092930525\25690194" -childID 6 -isForBrowser -prefsHandle 5292 -prefMapHandle 5168 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b48b2f1c-6ce3-4768-ad96-4f1c4632a229} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 5280 19bb2733e58 tab
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.8.1758292757\427977639" -childID 7 -isForBrowser -prefsHandle 5708 -prefMapHandle 5704 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0ae04c0-6d24-44b3-b6a4-d6ca31277889} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 5716 19bb44b8b58 tab
    3⤵
    PID:5224

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\UnlockCompress.csv"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EDZH8A20\KFOmCnqEu92Fr1Mu4mxK[1].woff2

Filesize
15KB

MD5
15d9f621c3bd1599f0169dcf0bd5e63e

SHA1
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52

SHA256
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

SHA512
d35a47162fc160cd5f806c3bb7feb50ec96fdfc81753660ead22ef33f89be6b1bfd63d1135f6b479d35c2e9d30f2360ffc8819efca672270e230635bcb206c82

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EDZH8A20\api[1].js

Filesize
14KB

MD5
fa26618d32d0714e94d965d4908e0e37

SHA1
bb6f9072da709ac36282fb02cd357eada3c67199

SHA256
712f936555ae41df42e9b4612deaf2a0eeae2074f2ba3767e721221fd1217863

SHA512
05d9183a86e5abf77920288d1dfe6dd5eb48146b64ff1ad0f2eec2a9dceacb2b0a496c72068debdb88076662d2c44a20cf76191717bcd40a587378441487e207

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EDZH8A20\m=NTMZac,m9oV,rCcCxc,RAnnUd,syw,sy2x,gJzDyc,sy36,sy37,uu7UOe,sy38,soHxf,sy39,uY3Nvd,syt,sys,HYv29e[1].js

Filesize
82KB

MD5
72d424a36f10e84104de613bcdde2084

SHA1
2b74d866379478d65a4ccf1298c5e345c283f2d4

SHA256
7d2e1dce30dcf6788acc266821f1832863c9e0571fbb43ed445219feb02ee870

SHA512
df66ae4b86eab01cb0d6544568a74358bdaeaf7be04441d9a40cc53b2d23f09bd31740c7c548f5b23a321d0a9b86fdbba2466484aff6833a2b81601611e668ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EDZH8A20\m=sy1f,sy1h,sy1i,sy1g,FoQBg[1].js

Filesize
37KB

MD5
0070f16d9d920534c9063542e08e62ce

SHA1
e70ea22a7ce81fe184c014105aebaa96009de033

SHA256
4de479aef87a24f30568ad23ba800b4f47ba86adda0c88e596d3d723c4502110

SHA512
6e279cd57ff8303d004a16b5aef1d1fb37c69966ed6b097f2042a028b0890fc604027bbb0b5eab4d0c578812d6079675f5866178caaed1bd9e7c764396b90d21

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EDZH8A20\m=sy2y,IZT63,vfuNJf,sy3n,sy3r,sy3t,sy44,sy42,sy43,siKnQd,sy3l,sy3s,sy3u,sy2z,YNjGDd,sy3v,PrPYRd,iFQyKf,hc6Ubd,sy45,SpsfSb,sy3o,sy3q,wR5FRb[1].js

Filesize
29KB

MD5
03a69ad540ea9f9f2fca1308b54cec4c

SHA1
a19a699d337909ad46e68036ba775bc86a3a7e00

SHA256
02e04650f266aef79664b28d514613757a5d0994af11a20d09cb215153a0a224

SHA512
f1e6029987f00e527f97b27cd52c8d9f419159c3533fa2b31d3f72812a8fbcfb923ce98f6cfd2e048e6baeabfa38ddff2db77406f50ad1bc34cc3e4ab663e577

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\EDZH8A20\rs=AGEqA5k0AMFGPITYL9Dd-4NoalAuh7T38A[1].css

Filesize
1.1MB

MD5
d6a896592b8143b479d23eabe94db14e

SHA1
55cf7237fba6b595008e12c9154818283146713a

SHA256
f8434272ef159dcd5f79dab03f577997f7ba7258dca4c288d569455db7259d53

SHA512
81b00a1d5334a54a3f3f4c3b87368d2021192b643a81b0393172e2e653787f395994fde976dd23eb4d2ac5a22c9e0291f055c93b215d45fe8fada810c7e8f8a4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G20V0RA5\4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk[1].woff2

Filesize
21KB

MD5
3300ca07eeb9979e159cf81c36f4b41f

SHA1
b904a403892ae08aded7ad087c9804f926920f2d

SHA256
bf7fd548e6b782afc630d74d28dc23043f5f7f1c4128d205369071830c878308

SHA512
d15ff7346781a7a0544d1a712e043d4e3d02f8007cb2cfd1245c916b2af1cea642b4dc3ce99509936fdf78e6d673743cdb0dde607386bf76166cf4ecac2da754

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G20V0RA5\4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk[1].woff2

Filesize
20KB

MD5
1435f3cfd01bf0f3c24b8983e6780db0

SHA1
439ab7ffa6f9d5b654710691d8736eedf2b6e892

SHA256
8cd3f9f312e86bade2e77eb25c28eba805707909441d49e29288944677ce6d47

SHA512
dded0517b2c8f6c6ea045ba87f3ae870df63843291c3e2219e7bdeb4e33baf360b5fdb6065f0566fd1c79253105574ee4ca8cb13a11f7e6a51bf20eacf03155b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G20V0RA5\KFOlCnqEu92Fr1MmEU9fBBc4[1].woff2

Filesize
15KB

MD5
3a44e06eb954b96aa043227f3534189d

SHA1
23cef6993ddb2b2979e8e7647fc3763694e2ba7d

SHA256
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

SHA512
fab970b250dd88064730bd2603c530f3503abb0af4e4095786877f9660a159bf4ad98c5abea2e95eb39ae8c13417736b5772fcb9f87941ff5e0f383cb172997f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G20V0RA5\KFOlCnqEu92Fr1MmSU5fBBc4[1].woff2

Filesize
15KB

MD5
b9c29351c46f3e8c8631c4002457f48a

SHA1
e57e59c5780995ff2937ab2b511a769212974a87

SHA256
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

SHA512
487ac3fd483f8ea131989857bcf1782c295ac72022bc2ebd4bf19001433d6db65000e192e58b7a6f70f627d15c58f9fed9ba5fe0216363354bec5a396299dad9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G20V0RA5\KFOlCnqEu92Fr1MmWUlfBBc4[1].woff2

Filesize
15KB

MD5
e9f5aaf547f165386cd313b995dddd8e

SHA1
acdef5603c2387b0e5bffd744b679a24a8bc1968

SHA256
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

SHA512
2a71edb5490f286642a874d52a1969f54282bc43cb24e8d5a297e13b320321fb7b7af5524eac609cf5f95ee08d5e4ec5803e2a3c8d13c09f6cc38713c665d0ce

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GBW5AAN2\cb=gapi[1].js

Filesize
324KB

MD5
eced6db395c8ef53a175b1702e30d015

SHA1
78487075f4df4a76c2f38b775f9aaaddcf8e0d5c

SHA256
3dfafdd876d82f0af3e9ca1a3603e69ec3814a81956426743f38f424af930f79

SHA512
4c9225cf90fde924da7472409f740732f373f7a67f10628d5ad09536c2733d26ac9d5eda23238720f8ad7d0ea18942140dac0932a941c3768b9cac5210c96b62

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GBW5AAN2\client[2].js

Filesize
14KB

MD5
800c94b5d752c495df3be431c4092337

SHA1
57cf794aad65a71f066458faf9cdcd8e5f43fab0

SHA256
e6947574246826cf7efa66aaad03e6d63fc8df1b5ebbe854ae50b92a5e2aa95b

SHA512
142ea5b8fa8d207408b22095166c02748607b44bcd2c9aee3c252bdb753bd32487f59d088c721969f4935ca7832b0afe75fd9837c8d17b078e5bb1c9f1c12dab

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GBW5AAN2\css[1].css

Filesize
1KB

MD5
c41b7e77a64795c55823953ad452276b

SHA1
049d9006b820e14feb73d289683c1fc8ecbeb153

SHA256
6d761b64b409fcddf307bfbfcd3eac5525d3c2e05d5ba6d9158474453c673c6c

SHA512
9bbcc3ed503327a52892b65768b9ddba5bee4eb9d5efc455a0ba4ce06a63a31eab76024b1d47b92f30c5e7e304086327ec7894dcf85f1fdde693ac0066fa73be

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GBW5AAN2\m=view[1].js

Filesize
620KB

MD5
2672b2e83c4d394e3fa2b7b38fa17e51

SHA1
4f0229e595ee63f7a5333ea6c979545e1fcd7d37

SHA256
0f1f90d9ec4e144b1cb17b30791a89e45357c6468d47d753a66e701dbde440cb

SHA512
2321621629079d476ee7db32361a3aa48185a749839740666dc58fd77867932d39a1dafe3386674e671725b8425f07322d65f1e9b1c88b5b6b9fb496ee843bdd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KSKTKYFM\cb=gapi[2].js

Filesize
60KB

MD5
a33884ec80a5c774c604a223c8ebd692

SHA1
8f1b6934131f9c330459147a831fbe6db1a20403

SHA256
3ddd4d9303f78796bf61d0fd99b0c501bea734ef24ce5e4bb35aece7de13153e

SHA512
c0e72756aad65de0d86bddec6f831a0fbafef891b651c5a71a86b5399842dc8e9550091bbdbbf46961dc88b18519de30f9de349a40725189fb4b6c4de699ee37

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KSKTKYFM\css[1].css

Filesize
1KB

MD5
92ba03d739f3de4520c3780d1cc10b79

SHA1
06b62f6de1d11480543c8e5aef986988a963d066

SHA256
40c51c6cdcff4c8e8b2d9a1ebe57c6222b89a36e53871c61184c92de5c2c76a0

SHA512
9fa7815390e59d5bbffe3701242e27b67a5afaa3b333c59950e6ff676f86198b122e7144f4a13f24abbfc060e53148950745e6e61bb051fc1c9bb68baf3e0024

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KSKTKYFM\m=HYv29e[1].js

Filesize
49KB

MD5
1d187435084da6ebd9f839a3730cd007

SHA1
d094fe137dd77f6d1837693a4b829644268004e4

SHA256
2f5315e4c9e3519fa1961f65a9bc8e05406a008104b53bff78e384d6f44ea05e

SHA512
90007d5bfc2c231789fe9f809057bf82a172da762cffa0fef087bd46d3bf5708e1b64fb9df1fe63b9f77077389769f22e1e654f7e78e6231ea9fd63d4acdd3da

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KSKTKYFM\m=sy32,TRvtze[1].js

Filesize
855B

MD5
b8484920826cff7b87eb9faa084371b0

SHA1
c3b7c3fe2b8e8ac632183e7dc2fcb92e67d610bf

SHA256
88999f991e8540c237ebccbf2e731135518257a1f0112563484a2eb1fffeab44

SHA512
47ecc6325e0a2fbc3ca5202cf571a9acfc57df1e4d659ab83dba63970e27925e480ae69a10ba5e7f1b02b4d5c1190a43089d49ff49d0359140d9758e06fef214

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\B813C467\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\U93LUENG\favicon[1].ico

Filesize
1KB

MD5
ea69a3f95dd5484853d128186db7e13d

SHA1
5fdb5fe05108fd6e5386bbda06778af4b446dc6a

SHA256
8179e80bcfef62154d1ff7371a1c60bd2c6c1e71c3da2f4a8b1db518a1900ec2

SHA512
2169d31065059c3677d025f27a5650c1e35bf83b6d6b3d80842b0809ff67e85388cb00213a4bd3fa76f71909a21298c824b39299a3980ba3b11c0297db472610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Excel\~ar7319.xar

Filesize
1.1MB

MD5
6063f7ae61ea225f1cea9425e714af01

SHA1
6c53e08a411dbfa161b5d3467bacbbfd5a9fcc33

SHA256
1138dfa803e6b73d376136cd94e1a70b51b88d8e3e21fabd14797f970ded6986

SHA512
9ec1dad8b90d9c00c43f489d5ada19ba14e1af472667a09bbafa700fbc8f6c0965afbca19a484f16ac767f718d4304c62f1053147c6adad3e6d21eef4d3d99c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
269B

MD5
534c0b71129cc9da02c293b1db404cea

SHA1
72d23fe18ccdb1c9e3c4bcb6e1fa203197774918

SHA256
009c0e37e2cc3e654d2e686e10c178c57aa1390f6e8005060a0725f0a7bd95c2

SHA512
aa021857475d166b4efa8cc33a121bc1224a84ac5815fe6d51b1a3c31b172fb0e01e38a3b80f0daf5b9e2966a4e507ffbe9c62620cacb5e0781247cccbf690b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
90fcd2acf0d78e341201ebe09ba0f84e

SHA1
0cb99ab586c3b3a789002a7d9f63c8c7de93e3dd

SHA256
32bf35978c559069464806dcb5822a89db8458197fc86b2209df409b37a09011

SHA512
6420e6061b2bd2ec754a59096affea8847239612313b18b392a3abdd1f0e2076f9065879acaafbc4afa3466510fe7ce926069dd4c1aaacbd224925ea51dadfea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\0cd3437a-330b-4dc8-af94-bab0ee70dcec

Filesize
11KB

MD5
2b25b84403ffd2ce0abc3f9c91613cba

SHA1
8718a8ff8b095940bfe2fb8581d0e54050eef23c

SHA256
947ebf1c0cafd57a9f4208bfca41405373a543198a7b21ed92b91a06c5f2c4e4

SHA512
6267c7582226945621df1c63e73292dee99feb55a02c95d04d9a8e812020cd41d7931189eb73eef65c03545bd33cf381c193ac276eb33397e2fc8515bc728652

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\79a18788-b16e-470f-8c97-3e4c1d2efb71

Filesize
746B

MD5
4db7cd88b2563baa49cf5255a1f88d21

SHA1
600559ec59ddc5881600694c4262f74c39e2fbae

SHA256
fe7ce9521ec69751d3f7362c58ef708f95f4d111bfa8c82f88354c9c60c36dfa

SHA512
e1a1565d5c53c65894eedfaa4a819ae1c350c7714b073d36dc78f8fee5b124167fffa4a667322e06a608d90133fff6ea9500f72604cc8cdaa770b264774202aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
bfe80a0360c94f6001ee03cc110a420e

SHA1
71cf4be9063780a1501caf522c682743bed61036

SHA256
1eea5e3467f7dbbf029a646f4709f925e763a87d5314812ca502cdff523bb968

SHA512
28462c70401724730f7e98f59a0ea73bb8a421f87da2eb33ec8eebdc4575ca3dd32b57f752d093562d8fe3f7b4ed82291ae3d2ac2bddd30c7e0ea8f73aeac756

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
a3b0e5fa469ebb4dd74c2ab96e83b479

SHA1
02a14a11f9f2d9f46df8a29f94fb846acf2248cd

SHA256
8ccbf2545e4932e67c1debcb67ac532e87d3bd8a0a8a83c5d665e6dc674e9ce8

SHA512
998bca52db4b94cde5922face3885bacf456b6fcb5c0640144986da0b333e0306ec05d233c763caddcdadc82c90766abd023e6ebba71cba3d26904404f42e089

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a34d4e46ea0ee05c12ce434c421a0327

SHA1
eac1cdb9d975755253c70125ec31ea97a1c9a353

SHA256
f90d0bc61b62fb078b3bdef610f8e8361e5fdabd22f649c2574669deda5462d5

SHA512
fd0620f652d523b807190c694d4c18eae369cba40351a835afb8875b3c85441ed4c75005526b4526af74f559c939073e70ab76413e273832b76cca8164f9177a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
8e805941e23cfc8d196caee7930aab1b

SHA1
ff4fd261995d23f1e45532c926390c51f1199c02

SHA256
89ab200c9c3510cd349eb217182b9d5c56b7041840bb06a07bf0b3f932de9178

SHA512
e5346da6bf726912c502094bfcd73cb01816c741cc099cc5c4e950e0902a72f63f050c5b58ae1a9481c70ab31d142ddd7ab147684516f579ae661ac72317a671

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
791db4fb662549ca002de078b629cea2

SHA1
1a33611f438d48a2fc65edf614d949811f3b98b8

SHA256
61d8c4e6506e71d5363299761f587d773bf12e5e88b98894c35119fd9eb9fe70

SHA512
8b94f1227b6e1cbb539015d532f1e356d2ad2f0c513bb8a3ec9b95349867429a43a18b363e9b08f4702b4ef682461924558f0f6a52db0606ba4f4be69eb10320

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
memory/520-0-0x000001A955420000-0x000001A955430000-memory.dmp

Filesize
64KB

Download
memory/520-16-0x000001A955520000-0x000001A955530000-memory.dmp

Filesize
64KB

Download
memory/520-35-0x000001A952AF0000-0x000001A952AF2000-memory.dmp

Filesize
8KB

Download
memory/852-45-0x00000254BB840000-0x00000254BB940000-memory.dmp

Filesize
1024KB

Download
memory/2444-69-0x000001CC6DD80000-0x000001CC6DD82000-memory.dmp

Filesize
8KB

Download
memory/2444-340-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-71-0x000001CC6DDA0000-0x000001CC6DDA2000-memory.dmp

Filesize
8KB

Download
memory/2444-338-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-316-0x000001CC73E00000-0x000001CC73F00000-memory.dmp

Filesize
1024KB

Download
memory/2444-204-0x000001CC6F830000-0x000001CC6F832000-memory.dmp

Filesize
8KB

Download
memory/2444-206-0x000001CC6F850000-0x000001CC6F852000-memory.dmp

Filesize
8KB

Download
memory/2444-202-0x000001CC6F820000-0x000001CC6F822000-memory.dmp

Filesize
8KB

Download
memory/2444-200-0x000001CC6F6E0000-0x000001CC6F6E2000-memory.dmp

Filesize
8KB

Download
memory/2444-197-0x000001CC6F680000-0x000001CC6F682000-memory.dmp

Filesize
8KB

Download
memory/2444-183-0x000001CC70F20000-0x000001CC70F40000-memory.dmp

Filesize
128KB

Download
memory/2444-99-0x000001CC72E60000-0x000001CC72E80000-memory.dmp

Filesize
128KB

Download
memory/2444-97-0x000001CC72880000-0x000001CC728A0000-memory.dmp

Filesize
128KB

Download
memory/2444-351-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-350-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-342-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-344-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-346-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-353-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-349-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-359-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-357-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-354-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-339-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-341-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-343-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-345-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-347-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-348-0x000001CC5D5C0000-0x000001CC5D5D0000-memory.dmp

Filesize
64KB

Download
memory/2444-67-0x000001CC6DD60000-0x000001CC6DD62000-memory.dmp

Filesize
8KB

Download