strrat | 8deb8ee811cbb3c186183950491c5c38da704b304057cdeaaf81b91e4f6e8a7e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
30/07/2024, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NCALayer-1.2.2-ADILETGOV.jar
Size

4KB
MD5

1d60146ca0a7eed20312eb2750e5ce10
SHA1

51b102215ba662c2b4c91df1403728d0894b1d2b
SHA256

8deb8ee811cbb3c186183950491c5c38da704b304057cdeaaf81b91e4f6e8a7e
SHA512

c2e2445ed728a2429bfcc8fb710de9a640b74b49f4b60361c7d7e23d115c0405e69276caf34828960fc8c8513b9d93fe8a7b02ecf59e816c6e072adc9c444993
SSDEEP

96:jp2KXysQ3U4dcJ4RN2cGWjklK1t/e0+U3n3XzuY3H8UAKQkH:jppCtQ4RGWjJb/F3H6giKD

Score

10^/10

strrat discovery persistence stealer trojan

Malware Config

Extracted

Family

strrat

https://pastebin.com/raw/67b8GSUQ:13777

https://pastebin.com/raw/8umPhg86:13778

Attributes

license_id
RPTV-2M8W-MG8W-F8QN-9ERV
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NCALayerServer.jar	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NCALayerServer.jar	java.exe

Loads dropped DLL 1 IoCs

pid	Process
3932	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NCALayerServer = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\NCALayerServer.jar\""	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NCALayerServer = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\NCALayerServer.jar\""	java.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
79	pastebin.com
32	pastebin.com
33	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4824	msedge.exe
4824	msedge.exe
5916	identity_helper.exe
5916	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4168	java.exe
4168	java.exe
4168	java.exe
4168	java.exe
4168	java.exe
4168	java.exe
4168	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4588	4168	java.exe	93
PID 4168 wrote to memory of 4588	4168	java.exe	93
PID 4168 wrote to memory of 4824	4168	java.exe	98
PID 4168 wrote to memory of 4824	4168	java.exe	98
PID 4824 wrote to memory of 2620	4824	msedge.exe	99
PID 4824 wrote to memory of 2620	4824	msedge.exe	99
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4960	4824	msedge.exe	100
PID 4824 wrote to memory of 4676	4824	msedge.exe	101
PID 4824 wrote to memory of 4676	4824	msedge.exe	101
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102
PID 4824 wrote to memory of 4256	4824	msedge.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\NCALayer-1.2.2-ADILETGOV.jar
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NCALayerServer.jar"
  2⤵
  PID:4588
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\NCALayerServer.jar"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    PID:3888
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\NCALayerServer.jar"
      4⤵
      PID:4024
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\NCALayerServer.jar"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1992
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\NCALayerServer.jar"
      4⤵
      Loads dropped DLL
      PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kgd.gov.kz/ru/app/culs-taxarrear-search-web
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc901e46f8,0x7ffc901e4708,0x7ffc901e4718
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 /prefetch:8
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13159053797097809990,1892066905502974529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2892 /prefetch:2
    3⤵
    PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc901e46f8,0x7ffc901e4708,0x7ffc901e4718
  2⤵
  PID:5648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
8afecdbe543aef35cb3391ee7db7958d

SHA1
3e20d6119b6fb61103340165d31ad63d350a3314

SHA256
c20e59c3f9bc5aed6e9d456788f96152fd590c3fcd85a75ad26111dd098b5991

SHA512
d0cf3cd485c4296eaf85859bae494a5d887e81bd9dc60278e998100b0afa9770011f9672d750e2f1c85a5f970f66d91375dd2b0b5a5221f98b44b9b3377941f0

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
ecfbf1716799f89b43973ab37d5d7bc2

SHA1
987738402f057507b9fe28e51e12e23d110b9783

SHA256
50a96296c09566a3c5d896011140768ded8f632e97d6501643d7693a9477445f

SHA512
0ea3236f9d8a3d2b6f90f0ec4b6f83a6457e828f0a7e9e03166588cad972ff2307d4edffd1c5810bb8a489fabd80b39c81fdf65f8706ca5e3b7054291decc762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
214KB

MD5
51da1dedb94b050c315b0c2b7fbd29d2

SHA1
e78c768e4d0fa5248ac621a20ce3b8a79d86774c

SHA256
286a7889d01197a5b6327599e21839fba30260dda7973ec964d694d4ae4ddcfd

SHA512
713fb541019217b86321d14ddbe98b6e081a319aab4f00721db6369b2f81c9e5b620e2d0ed503e755fe2c3c3f35de4a3729121818dd1fcc18d633d86c90bad6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
506e8b0415d85ec33d18b178f4707de1

SHA1
fe00de8b42253553d55fe7a4efdba8e7de49aa6c

SHA256
4c72aea63c0e587184ef79bbabb9d336c9adad25f79a137ca63d0a92aa9bfa7a

SHA512
082c3d145bdf92f41d459b1d898251a5cd023a106c0dd3894ccae95da2e2fead1c63822daf3d60cb241700affa3fcc27ee4e76f519e8a83cf7c56e0918c832e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9b24851bfef79090463fddb64e2b150c

SHA1
06e3386613596a69a2c0a55da0553c1cbbb4ccc7

SHA256
c319936133bd4c1dcbcc4df12be5edea14af31185ff6ad093b0858217e9d9df6

SHA512
b289485ef99fe0b5030d2aea91b3e378f9fc81cf0a3c683a138ad47931622391355993c970d9cdd66c0e0421db7df796e2d0f0d5ddb9eccd8074610511872c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c2a7be4ab1650cbd3199b7c594f943b

SHA1
4e12bad1b8fc7853745a13b7e8b446d5bad4438e

SHA256
8bf290c38709beeb85bf467ae52b45bdae0eb9d49d75c05265cc58eb631135b2

SHA512
fc5ddb63ae11c102b0d0a6451ca230be3b86e69a6b35b72c73882f63a9408f13433c0103668e9d9d97502bad210d27da04dbee0ec49d4acbd7ad6c93ab285c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09837885d35cd8c91fbd6305c9416a78

SHA1
714d92ab172585b77a0dc84ddcb6f52f89cd81f7

SHA256
236acf2d59cfa7a3376c425b3606c7f5a9e2ee6a53a3171bcfbb6d6bb92024e9

SHA512
d6dca145fe37ad956ac5f42cb0a878ba28058ce9040806c98654ea4f5799f1df3c0df6a0d66ce85523a831a1cc919025224aabc6b42c2c251fd19227a0b40b60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a78345ba852430e7479241536402114

SHA1
f2f55af41fcc46aae7d6928f7cbc55cafc6523b7

SHA256
f743caee373a377d3968da5cc083d42855b2304c94a2bfaac97ca8fb91c1d797

SHA512
96e4c7feaef1f54042181fdf9a8f009f963c5eccfcd2b383680dd8cb46f56a35141fbe9bd1dffc6f7acb4fcab8418c446537cbacc858f81412eca7c9e33d98ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
876B

MD5
8c3c2b3080f610014493c60242b12757

SHA1
9bd7b5a51f6c41f572ce82c0b80fb705559635cb

SHA256
44c07d44d1820cc385fbf750b26288419bac9107901b9a0934491228b1dc618a

SHA512
8579ee84a22747141b400c883ca7c5c2e5f19c30fb6e5f23fa2cab0e63952a1afa3c9529b6c1440e7fe71a033f874380c2ab1e845f8b58accca86e5cbccda032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c8c9.TMP

Filesize
876B

MD5
0ae4546131145d1b306f9efb512d8890

SHA1
5e2cbd716b7fb677da9683d3dab74cf45d24523c

SHA256
d518a01db9e27763e62b9796348ef25bd14261df9f35e952bec74a46332cecd5

SHA512
7e8c25d980c903c576a13651a91d58be0b0b04e2492a19328704a050bce77d09e706cea787f2270a3dbb3ed1f00f136433de2276fd52111516c156e66e613857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
12cb0d442e8db457cd9a8d647e82d031

SHA1
036d1ac67de401227f1863b13bd697da20fb5d9d

SHA256
efda06ad9a3ec9bebc4a843fa579e64302ec061317d9c2e581670d2dc4e284dc

SHA512
ddb2d69dc0c4d5fcb57cfcc934e0ae5030c21182bf888b476bc05d512b72ed66fc141f457b782920010cf0b2099842c63b38a4dc2c1c97b003030b0e486d95e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0c0196978f860631b77e57a30c795ac

SHA1
c5d6342b31c1b61e5813f21e75c261fdb54e2cb4

SHA256
3e788fa33fbd29e0ee779048c254d1c322437df2475f6901d0b9cbf2cdc01543

SHA512
20d5f99621d4ef721584f3ca72d3acad1951f4a26f51c4b3ca8157ecda2e337cf89afb9dc24b7231d261a5a61cf436defe85510a79e35ab483253327087ba7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna6719177687356094081.dll

Filesize
241KB

MD5
e02979ecd43bcc9061eb2b494ab5af50

SHA1
3122ac0e751660f646c73b10c4f79685aa65c545

SHA256
a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a

SHA512
1e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-464762018-485119342-1613148473-1000\83aa4cc77f591dfc2374580bbd95f6ba_a18f179e-3e6f-4f43-8bbf-9eee996556bc

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NCALayerServer.jar

Filesize
260KB

MD5
db1f4f896485b042cee363e2f33d2f55

SHA1
b6a25190e6aaea8fcfd53b734b68e3c7065f837e

SHA256
d1b67ec03fa5c71df2f2f90263bd69a9626cba5922c9acfb7ca2af73c8db614c

SHA512
c898f6d8c34499104da762314ec5bd613dbe24e4d3b0eb86603900ba9d334c8b801132943a4419f3dad4865782953db1bfa4ce9161693b32a2b24c3a3e45fa9d

Download Submit
C:\Users\Admin\lib\jna-5.5.0.jar

Filesize
1.4MB

MD5
acfb5b5fd9ee10bf69497792fd469f85

SHA1
0e0845217c4907822403912ad6828d8e0b256208

SHA256
b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e

SHA512
e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa

Download Submit
C:\Users\Admin\lib\jna-platform-5.5.0.jar

Filesize
2.6MB

MD5
2f4a99c2758e72ee2b59a73586a2322f

SHA1
af38e7c4d0fc73c23ecd785443705bfdee5b90bf

SHA256
24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5

SHA512
b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494

Download Submit
C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jar

Filesize
4.1MB

MD5
b33387e15ab150a7bf560abdc73c3bec

SHA1
66b8075784131f578ef893fd7674273f709b9a4c

SHA256
2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491

SHA512
25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279

Download Submit
C:\Users\Admin\lib\system-hook-3.5.jar

Filesize
772KB

MD5
e1aa38a1e78a76a6de73efae136cdb3a

SHA1
c463da71871f780b2e2e5dba115d43953b537daf

SHA256
2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609

SHA512
fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d

Download Submit
memory/4168-146-0x000001CABB3B0000-0x000001CABB3C0000-memory.dmp

Filesize
64KB

Download
memory/4168-191-0x000001CABB410000-0x000001CABB420000-memory.dmp

Filesize
64KB

Download
memory/4168-71-0x000001CABB2A0000-0x000001CABB2B0000-memory.dmp

Filesize
64KB

Download
memory/4168-70-0x000001CABB290000-0x000001CABB2A0000-memory.dmp

Filesize
64KB

Download
memory/4168-69-0x000001CABB280000-0x000001CABB290000-memory.dmp

Filesize
64KB

Download
memory/4168-77-0x000001CABB2C0000-0x000001CABB2D0000-memory.dmp

Filesize
64KB

Download
memory/4168-79-0x000001CABB370000-0x000001CABB380000-memory.dmp

Filesize
64KB

Download
memory/4168-76-0x000001CABB2B0000-0x000001CABB2C0000-memory.dmp

Filesize
64KB

Download
memory/4168-83-0x000001CABB380000-0x000001CABB390000-memory.dmp

Filesize
64KB

Download
memory/4168-82-0x000001CABB2D0000-0x000001CABB2E0000-memory.dmp

Filesize
64KB

Download
memory/4168-86-0x000001CABB2E0000-0x000001CABB2F0000-memory.dmp

Filesize
64KB

Download
memory/4168-90-0x000001CABB2F0000-0x000001CABB300000-memory.dmp

Filesize
64KB

Download
memory/4168-89-0x000001CABB3A0000-0x000001CABB3B0000-memory.dmp

Filesize
64KB

Download
memory/4168-88-0x000001CABB390000-0x000001CABB3A0000-memory.dmp

Filesize
64KB

Download
memory/4168-93-0x000001CABB3B0000-0x000001CABB3C0000-memory.dmp

Filesize
64KB

Download
memory/4168-92-0x000001CABB310000-0x000001CABB320000-memory.dmp

Filesize
64KB

Download
memory/4168-91-0x000001CABB300000-0x000001CABB310000-memory.dmp

Filesize
64KB

Download
memory/4168-96-0x000001CABB320000-0x000001CABB330000-memory.dmp

Filesize
64KB

Download
memory/4168-98-0x000001CABB3D0000-0x000001CABB3E0000-memory.dmp

Filesize
64KB

Download
memory/4168-97-0x000001CABB3C0000-0x000001CABB3D0000-memory.dmp

Filesize
64KB

Download
memory/4168-101-0x000001CAB9700000-0x000001CAB9701000-memory.dmp

Filesize
4KB

Download
memory/4168-104-0x000001CABB330000-0x000001CABB340000-memory.dmp

Filesize
64KB

Download
memory/4168-105-0x000001CABB3E0000-0x000001CABB3F0000-memory.dmp

Filesize
64KB

Download
memory/4168-107-0x000001CABB340000-0x000001CABB350000-memory.dmp

Filesize
64KB

Download
memory/4168-108-0x000001CABB3F0000-0x000001CABB400000-memory.dmp

Filesize
64KB

Download
memory/4168-112-0x000001CABB400000-0x000001CABB410000-memory.dmp

Filesize
64KB

Download
memory/4168-111-0x000001CABB350000-0x000001CABB360000-memory.dmp

Filesize
64KB

Download
memory/4168-114-0x000001CAB9700000-0x000001CAB9701000-memory.dmp

Filesize
4KB

Download
memory/4168-115-0x000001CAB9700000-0x000001CAB9701000-memory.dmp

Filesize
4KB

Download
memory/4168-116-0x000001CAB9700000-0x000001CAB9701000-memory.dmp

Filesize
4KB

Download
memory/4168-117-0x000001CABB360000-0x000001CABB370000-memory.dmp

Filesize
64KB

Download
memory/4168-119-0x000001CABB410000-0x000001CABB420000-memory.dmp

Filesize
64KB

Download
memory/4168-118-0x000001CABB370000-0x000001CABB380000-memory.dmp

Filesize
64KB

Download
memory/4168-123-0x000001CABB380000-0x000001CABB390000-memory.dmp

Filesize
64KB

Download
memory/4168-125-0x000001CABB390000-0x000001CABB3A0000-memory.dmp

Filesize
64KB

Download
memory/4168-138-0x000001CAB9700000-0x000001CAB9701000-memory.dmp

Filesize
4KB

Download
memory/4168-141-0x000001CABB3A0000-0x000001CABB3B0000-memory.dmp

Filesize
64KB

Download
memory/4168-66-0x000001CABB260000-0x000001CABB270000-memory.dmp

Filesize
64KB

Download
memory/4168-142-0x000001CABB420000-0x000001CABB430000-memory.dmp

Filesize
64KB

Download
memory/4168-17-0x000001CAB9700000-0x000001CAB9701000-memory.dmp

Filesize
4KB

Download
memory/4168-2-0x000001CABAFC0000-0x000001CABB230000-memory.dmp

Filesize
2.4MB

Download
memory/4168-68-0x000001CABB350000-0x000001CABB360000-memory.dmp

Filesize
64KB

Download
memory/4168-159-0x000001CABB3D0000-0x000001CABB3E0000-memory.dmp

Filesize
64KB

Download
memory/4168-24-0x000001CABB240000-0x000001CABB250000-memory.dmp

Filesize
64KB

Download
memory/4168-158-0x000001CABB3C0000-0x000001CABB3D0000-memory.dmp

Filesize
64KB

Download
memory/4168-23-0x000001CABB230000-0x000001CABB240000-memory.dmp

Filesize
64KB

Download
memory/4168-162-0x000001CABB3E0000-0x000001CABB3F0000-memory.dmp

Filesize
64KB

Download
memory/4168-26-0x000001CABB250000-0x000001CABB260000-memory.dmp

Filesize
64KB

Download
memory/4168-30-0x000001CABB270000-0x000001CABB280000-memory.dmp

Filesize
64KB

Download
memory/4168-182-0x000001CABB400000-0x000001CABB410000-memory.dmp

Filesize
64KB

Download
memory/4168-29-0x000001CABB260000-0x000001CABB270000-memory.dmp

Filesize
64KB

Download
memory/4168-36-0x000001CABB2A0000-0x000001CABB2B0000-memory.dmp

Filesize
64KB

Download
memory/4168-35-0x000001CABB290000-0x000001CABB2A0000-memory.dmp

Filesize
64KB

Download
memory/4168-34-0x000001CABB280000-0x000001CABB290000-memory.dmp

Filesize
64KB

Download
memory/4168-167-0x000001CABB3F0000-0x000001CABB400000-memory.dmp

Filesize
64KB

Download
memory/4168-41-0x000001CABB2C0000-0x000001CABB2D0000-memory.dmp

Filesize
64KB

Download
memory/4168-72-0x000001CABB360000-0x000001CABB370000-memory.dmp

Filesize
64KB

Download
memory/4168-40-0x000001CABB2B0000-0x000001CABB2C0000-memory.dmp

Filesize
64KB

Download
memory/4168-45-0x000001CABB2E0000-0x000001CABB2F0000-memory.dmp

Filesize
64KB

Download
memory/4168-199-0x000001CABB420000-0x000001CABB430000-memory.dmp

Filesize
64KB

Download
memory/4168-44-0x000001CABB2D0000-0x000001CABB2E0000-memory.dmp

Filesize
64KB

Download
memory/4168-43-0x000001CABAFC0000-0x000001CABB230000-memory.dmp

Filesize
2.4MB

Download
memory/4168-47-0x000001CABB2F0000-0x000001CABB300000-memory.dmp

Filesize
64KB

Download
memory/4168-50-0x000001CABB300000-0x000001CABB310000-memory.dmp

Filesize
64KB

Download
memory/4168-51-0x000001CABB310000-0x000001CABB320000-memory.dmp

Filesize
64KB

Download
memory/4168-55-0x000001CABB320000-0x000001CABB330000-memory.dmp

Filesize
64KB

Download
memory/4168-54-0x000001CABB230000-0x000001CABB240000-memory.dmp

Filesize
64KB

Download
memory/4168-58-0x000001CABB330000-0x000001CABB340000-memory.dmp

Filesize
64KB

Download
memory/4168-388-0x000001CAB9700000-0x000001CAB9701000-memory.dmp

Filesize
4KB

Download
memory/4168-57-0x000001CABB240000-0x000001CABB250000-memory.dmp

Filesize
64KB

Download
memory/4168-62-0x000001CABB340000-0x000001CABB350000-memory.dmp

Filesize
64KB

Download
memory/4168-61-0x000001CABB250000-0x000001CABB260000-memory.dmp

Filesize
64KB

Download
memory/4168-67-0x000001CABB270000-0x000001CABB280000-memory.dmp

Filesize
64KB

Download
memory/4588-208-0x000001E2A12D0000-0x000001E2A12E0000-memory.dmp

Filesize
64KB

Download
memory/4588-215-0x000001E2A1230000-0x000001E2A1240000-memory.dmp

Filesize
64KB

Download
memory/4588-221-0x000001E2A1250000-0x000001E2A1260000-memory.dmp

Filesize
64KB

Download
memory/4588-223-0x000001E2A1320000-0x000001E2A1330000-memory.dmp

Filesize
64KB

Download
memory/4588-222-0x000001E2A1260000-0x000001E2A1270000-memory.dmp

Filesize
64KB

Download
memory/4588-229-0x000001E2A1330000-0x000001E2A1340000-memory.dmp

Filesize
64KB

Download
memory/4588-228-0x000001E2A1270000-0x000001E2A1280000-memory.dmp

Filesize
64KB

Download
memory/4588-257-0x000001E29F710000-0x000001E29F711000-memory.dmp

Filesize
4KB

Download
memory/4588-268-0x000001E29F710000-0x000001E29F711000-memory.dmp

Filesize
4KB

Download
memory/4588-295-0x000001E29F710000-0x000001E29F711000-memory.dmp

Filesize
4KB

Download
memory/4588-302-0x000001E29F710000-0x000001E29F711000-memory.dmp

Filesize
4KB

Download
memory/4588-216-0x000001E2A1240000-0x000001E2A1250000-memory.dmp

Filesize
64KB

Download
memory/4588-217-0x000001E2A1300000-0x000001E2A1310000-memory.dmp

Filesize
64KB

Download
memory/4588-218-0x000001E2A1310000-0x000001E2A1320000-memory.dmp

Filesize
64KB

Download
memory/4588-354-0x000001E29F710000-0x000001E29F711000-memory.dmp

Filesize
4KB

Download
memory/4588-210-0x000001E2A1210000-0x000001E2A1220000-memory.dmp

Filesize
64KB

Download
memory/4588-207-0x000001E2A1200000-0x000001E2A1210000-memory.dmp

Filesize
64KB

Download
memory/4588-211-0x000001E2A12F0000-0x000001E2A1300000-memory.dmp

Filesize
64KB

Download
memory/4588-183-0x000001E2A1250000-0x000001E2A1260000-memory.dmp

Filesize
64KB

Download
memory/4588-209-0x000001E2A12E0000-0x000001E2A12F0000-memory.dmp

Filesize
64KB

Download
memory/4588-200-0x000001E2A0F90000-0x000001E2A1200000-memory.dmp

Filesize
2.4MB

Download
memory/4588-201-0x000001E2A12B0000-0x000001E2A12C0000-memory.dmp

Filesize
64KB

Download
memory/4588-202-0x000001E2A12C0000-0x000001E2A12D0000-memory.dmp

Filesize
64KB

Download
memory/4588-203-0x000001E29F710000-0x000001E29F711000-memory.dmp

Filesize
4KB

Download
memory/4588-196-0x000001E2A12A0000-0x000001E2A12B0000-memory.dmp

Filesize
64KB

Download
memory/4588-195-0x000001E2A1290000-0x000001E2A12A0000-memory.dmp

Filesize
64KB

Download
memory/4588-193-0x000001E2A1280000-0x000001E2A1290000-memory.dmp

Filesize
64KB

Download
memory/4588-168-0x000001E2A1220000-0x000001E2A1230000-memory.dmp

Filesize
64KB

Download
memory/4588-214-0x000001E2A1220000-0x000001E2A1230000-memory.dmp

Filesize
64KB

Download
memory/4588-184-0x000001E2A1260000-0x000001E2A1270000-memory.dmp

Filesize
64KB

Download
memory/4588-185-0x000001E2A1270000-0x000001E2A1280000-memory.dmp

Filesize
64KB

Download
memory/4588-170-0x000001E2A1240000-0x000001E2A1250000-memory.dmp

Filesize
64KB

Download
memory/4588-169-0x000001E2A1230000-0x000001E2A1240000-memory.dmp

Filesize
64KB

Download
memory/4588-163-0x000001E2A1210000-0x000001E2A1220000-memory.dmp

Filesize
64KB

Download
memory/4588-161-0x000001E2A1200000-0x000001E2A1210000-memory.dmp

Filesize
64KB

Download
memory/4588-147-0x000001E2A0F90000-0x000001E2A1200000-memory.dmp

Filesize
2.4MB

Download