hxxps://www[.]youdaoxxv[.]icu

Resubmissions

20-08-2024 11:43

240820-nvn6tszbre 6

20-08-2024 11:32

240820-nnf7mstbjk 6

Analysis

max time kernel
35s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20-08-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youdaoxxv.icu

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005dd220aaaddbbb30a7bb50e7862750ef35c047f33162ef753238fd5a2e82b5da4540172df631c266e9d800f763371489d74ce143af57ab87e895	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 873eaeabf4f2da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 834602a6f4f2da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4283dea5f4f2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = be8cbcabf4f2da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1724	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1724	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1724	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3032	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3032	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5104	MicrosoftEdge.exe
4244	MicrosoftEdgeCP.exe
1724	MicrosoftEdgeCP.exe
4244	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1588	4244	MicrosoftEdgeCP.exe	76
PID 4244 wrote to memory of 1588	4244	MicrosoftEdgeCP.exe	76
PID 4244 wrote to memory of 1588	4244	MicrosoftEdgeCP.exe	76
PID 4244 wrote to memory of 1588	4244	MicrosoftEdgeCP.exe	76
PID 4244 wrote to memory of 1588	4244	MicrosoftEdgeCP.exe	76
PID 4244 wrote to memory of 1588	4244	MicrosoftEdgeCP.exe	76
PID 4244 wrote to memory of 1588	4244	MicrosoftEdgeCP.exe	76
PID 4244 wrote to memory of 3584	4244	MicrosoftEdgeCP.exe	78
PID 4244 wrote to memory of 3584	4244	MicrosoftEdgeCP.exe	78
PID 4244 wrote to memory of 3584	4244	MicrosoftEdgeCP.exe	78

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.youdaoxxv.icu"
1⤵
PID:5036

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5104

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1588

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CURPHQ3V\0KEXVN51.htm

Filesize
15KB

MD5
03a518416b5bee8ea666bbb1c1e9f18c

SHA1
93901be2c512377efa08fb9272cef28202f93d1f

SHA256
754f6cb2ecbb2f54fc739e195788bd462cb155730a690c855d7beeb10221e78a

SHA512
17d6957fcc2d1b858c033027b9a7d4b0bb0e3959bd758bc53fa9617187a229e572e1a9cdb0835eb6a33af6fe349bb531b39c2b1cc3dc9acd837d653ffc17f743

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_5DAD0A0F3452182BB1C0BBBB5CE037DC

Filesize
406B

MD5
d7de5fdac06e94f3fe21979a2c95e17b

SHA1
8ea7f0d684f04fa62102273aad9ac496c107c2a3

SHA256
19d4d0f4dc521067d90129038e53a679921804d95de6d0e014f854acf7aa229e

SHA512
4957bd409759570c8e31de09a6c7303f588bd75d180e60b2bc09a3e012092b0c47d8cc158c7c0b9145339fce88486386398d3c5787751fea69f9f7b9f21f7745

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3IJIJAFG\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AKZ1D1LE\chunk-d0c47082.fca6895a[1].css

Filesize
1KB

MD5
b22468cfc8b06a1fac8018b7d628196e

SHA1
c2f9830639042c7772202386bf2bb25c9d958474

SHA256
cb159f84393929d888cccca68403c926b7b5f5bb134a3b0904a1189ed20ba32d

SHA512
58d602bf9017eb010b1aa397c3a72b9101bb68d60ed5f37bf1558b111964ddebb400ae40a6b0c246c8999671a9c0d5a818e753bf033458007d0f4e492b795bf3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AKZ1D1LE\jquery.min[1].js

Filesize
94KB

MD5
4f252523d4af0b478c810c2547a63e19

SHA1
5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb

SHA256
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

SHA512
8c6b0c1fcde829ef5ab02a643959019d4ac30d3a7cc25f9a7640760fefff26d9713b84ab2e825d85b3b2b08150265a10143f82e05975accb10645efa26357479

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CURPHQ3V\chunk-0fd607bd.b557bb3e[1].css

Filesize
1KB

MD5
488e287ea8a85df3dc37c2c4f32355c9

SHA1
78c3ea80d1edb93c759039152703bf18149a421b

SHA256
1664a2a8d3bb8375347b50608a4e0f7799421378ab6cb644697dd2c879500c6c

SHA512
549ed8b67195ca4016e87aa003449423d11d7d874ca56aae393af2432dcd12cbba2f09410da8872aa943dfcc8ead01b307356a83bf7c5a9ad2a16a39eb16bfa3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CURPHQ3V\fanyi_logo.2c2e760f[1].png

Filesize
15KB

MD5
e7915a5e2660775a7ef272bddd995990

SHA1
719c484dd64dac4b8186eef7bb78dd81e454dbcf

SHA256
697d118d5147745502452a447786ac4600aca03efb8333b3c12b91c038a13c5f

SHA512
15bbd499edc42059eb5cf0781b69f19e6f0f7a8f124e2458dec50ca7c7666f5891a5a5bc15c33d1d450bee4d0dcd973b73a5385b1c313d0c931979641c01e00e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FJT5PZ3H\rem[1].js

Filesize
1KB

MD5
412f13682f6abbf85a6d928dc734cf83

SHA1
d1aa4895db9a21ab42a45b4af0ccd5af2ec24804

SHA256
2d211a10ab35836a1a1b0f83075ce9209f7408c1eca1414b0705865e01c5c00c

SHA512
1667a5ea596b25de7bb31d342c2c0c3a3834588bda67190950274c1677651b8853d4e37ad0d5cebe77d57757341fd2f3f9157e414dc87eb29b5434c9c20bbda3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FJT5PZ3H\v1[1].js

Filesize
5KB

MD5
8de5cf087e0c717085a070c7d04bb52f

SHA1
2fa84ec5f4792a58b5c434a618e78432e33c0703

SHA256
149b7643610d6ffd2263dfca4304977d8d202ad9e0c145a1e92cf75146ac587c

SHA512
e70919b8a9a1028fd16b60195c1b1e9e0d898525d7a5c4529f6eb93a661b48205f153d9edb3f46c49dce6d5edba0d31cde70e37d514436a6cf2480f394d5c6d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GXXGF5SS\30c34b0f828512075b49efb2c7ef2b7e[1].gif

Filesize
174KB

MD5
f011e2097c4228b36bf4b56f835ad039

SHA1
066fb12d4002b6c91b01759f5ed1994164fbe4f3

SHA256
df5a97320210e6b06c0d80d987321df87938c4c204b54efe943c8cb8a63c5a8f

SHA512
0231dc58b4d1d2ae61d36902375d95e6af7dcf3338baf0ddebe0c041f82d1fd285933cb806439f1653c6488db61dc63985eed276aab4bb3aa1eb59df5555307b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GXXGF5SS\app.2d460f56[1].css

Filesize
15KB

MD5
bb8113dce8669752b068e645cf5bd8c8

SHA1
12abfea093fb2c841bfa92ccbdc70c31ae40d3da

SHA256
cfb5b0be405b0c2a86b10864656e134c786d6a2a0567ad2b8b5ef432a3a35ea6

SHA512
2b30c47706a1f4f96052a9abd7b7bbb2d8132ac5c2930dc76c63d146ca4b50ffacc5e6f83b6869f44e1e64928bb37dcac3f6795507b801c4768eb0570de0fdbc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\GXXGF5SS\chunk-vendors.55784a03[1].css

Filesize
33KB

MD5
c144755169afea42d0f774a4d5b085e7

SHA1
0241106b228c8146e74c32e58b451c2279fbf584

SHA256
a242827958301a095c1c502e1de4eea2904f3f38976c96ce9c7f20a7b4377305

SHA512
679bc33f0c09bf076cf9bab42d79b7450bbf925c1ecadee6dd688731ca9b16b6ac66cfbbd3cee5320e0fbf582f2c0c70c8a95f53ebca79de76921f76cd3b2e76

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\3DCCE08CADBFCFB54B60E8F0093F869F

Filesize
504B

MD5
402c10da7b93ea0180f63b693c243a52

SHA1
5570d1e476de9401424a17b61b55b52fc699f464

SHA256
a85e2939d0edb2f9e48522f8f56038601bd7c46c8e63bd2b0b6ae90afa0e56d7

SHA512
734db584e90c76af177a1090884a105ecfe2dc25975119cd0821f9adf447d5d82a46152136bbe81eabbaf13edcb29a6a9cb91d316f96d6623f2304c7e7f4f71e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2

Filesize
471B

MD5
bd4fb238a22fb6ac0a4de90228ad2119

SHA1
2253e9f48b0585671de299b5d7b2c3b698e28e68

SHA256
324e5af15df81d71b5dff3261a5e96d68a4b216f156f5287458ce63ec35540a3

SHA512
fd28528d4ad89610efea414a2d61deb3127d7cc58a79c6a3424386c61be8708a5c0e3d4c61bd2f8c9cd458233fc837a4554bc494472a7cc686451efc138afa76

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_175AA887E5F53442EA7A85DC71939C17

Filesize
471B

MD5
43ea210c191db5edca03195fab1a4289

SHA1
5bf0c7753698d2dd40134a7d28e159156b38a264

SHA256
a74cc7ec033d285f1ed5bef82997b075545bff60189e2e8f9d126b72eb20c51f

SHA512
657994a2d6e9ad469b9ba4aa3a8008aebe3b2dec87873d8cd8c4da381b07051a5bec0af459ba39f1e89b867b566914b06b56b82437bd3bf6ade08b6499154718

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
c32a510633120c5c6bd79a12c0e716cf

SHA1
8ae3b838516fab51e6bfbfeb14dda75863e45bb0

SHA256
5c6428e91872587ef63ea7129c1e6b4ef7b0a9d9f8e51ac0cfef9a00b747a7e7

SHA512
d347c9cb103708c8d093f3726358aea6dd9e2d9441606381a91cc2562f36bb0b7f805f604c5d274633d9d7dc5a728af02d7b4ccfc76024e8f6c6de8e96b280e1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\3DCCE08CADBFCFB54B60E8F0093F869F

Filesize
550B

MD5
e20fa92b41c1d392e433d368c941a621

SHA1
fba0f23518878089d5f805548c6370fce0b96a5e

SHA256
a30d1630d2f6eb4de1ed0f95922d357201ec78e818e37b3fdcd2dfe9d9dd3676

SHA512
e7e008cd43baa316183022e3c6439fc8ad6aa6e89ec93587e90993d116b5c3932cf7454041c4a5ff3a2a8f064738082ababdf50cf75bc1afb8238d64f3474c99

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2

Filesize
402B

MD5
e398c17160f74f14b68c74affc83e965

SHA1
c942638270354980e0bf45580739110caf46a8d3

SHA256
db9a0bc14ed82e124a8adacff7397036d9e109b57ac6b6d0c1392159481c6a64

SHA512
3fd538b8b51e9b927a6f7d357885dfb092771e2cc337da81a0646311f50a39718654ce5cf36e84f032696a38acdf8545dcbc23c27201dec5b0fc9e8803f587ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_175AA887E5F53442EA7A85DC71939C17

Filesize
406B

MD5
7e4ab1ea247ca01b95466387826509c3

SHA1
2c48e5c4823bcca138ab62fc67baba1da04a9e29

SHA256
6412be9fa126918f404cde82b708b389934151239e7b96ce3f0bc2252d155de1

SHA512
82dd0b3b8b06ceb82b17848d5cbd49a3583643cdc51405b7ddac7c0afe9025b1b55f9fd959f874af6cdd883b9dcfc9903e5141744697f6bcfb7b7082934609f4

Download Submit
memory/1588-133-0x000001FAD7C00000-0x000001FAD7D00000-memory.dmp

Filesize
1024KB

Download
memory/1588-178-0x000001FAD8240000-0x000001FAD8340000-memory.dmp

Filesize
1024KB

Download
memory/1588-215-0x000001FAD8240000-0x000001FAD8340000-memory.dmp

Filesize
1024KB

Download
memory/1588-228-0x000001FAC7310000-0x000001FAC7410000-memory.dmp

Filesize
1024KB

Download
memory/1588-237-0x000001FAD7410000-0x000001FAD7510000-memory.dmp

Filesize
1024KB

Download
memory/1588-246-0x000001FAD7410000-0x000001FAD7510000-memory.dmp

Filesize
1024KB

Download
memory/1588-259-0x000001FAD7940000-0x000001FAD7A40000-memory.dmp

Filesize
1024KB

Download
memory/1588-264-0x000001FAD7940000-0x000001FAD7A40000-memory.dmp

Filesize
1024KB

Download
memory/1588-281-0x000001FAD7C00000-0x000001FAD7D00000-memory.dmp

Filesize
1024KB

Download
memory/1588-282-0x000001FAD7C00000-0x000001FAD7D00000-memory.dmp

Filesize
1024KB

Download
memory/1588-299-0x000001FAD7DE0000-0x000001FAD7EE0000-memory.dmp

Filesize
1024KB

Download
memory/1588-304-0x000001FAD7DE0000-0x000001FAD7EE0000-memory.dmp

Filesize
1024KB

Download
memory/1588-317-0x000001FAD80A0000-0x000001FAD81A0000-memory.dmp

Filesize
1024KB

Download
memory/1588-326-0x000001FAD80A0000-0x000001FAD81A0000-memory.dmp

Filesize
1024KB

Download
memory/1588-198-0x000001FAD84E0000-0x000001FAD85E0000-memory.dmp

Filesize
1024KB

Download
memory/1588-197-0x000001FAD84E0000-0x000001FAD85E0000-memory.dmp

Filesize
1024KB

Download
memory/1588-191-0x000001FAD8240000-0x000001FAD8340000-memory.dmp

Filesize
1024KB

Download
memory/1588-196-0x000001FAD84E0000-0x000001FAD85E0000-memory.dmp

Filesize
1024KB

Download
memory/1588-173-0x000001FAD80A0000-0x000001FAD81A0000-memory.dmp

Filesize
1024KB

Download
memory/1588-156-0x000001FAD80A0000-0x000001FAD81A0000-memory.dmp

Filesize
1024KB

Download
memory/1588-155-0x000001FAD7DE0000-0x000001FAD7EE0000-memory.dmp

Filesize
1024KB

Download
memory/1588-138-0x000001FAD7DE0000-0x000001FAD7EE0000-memory.dmp

Filesize
1024KB

Download
memory/1588-68-0x000001FAC6F60000-0x000001FAC6F62000-memory.dmp

Filesize
8KB

Download
memory/1588-120-0x000001FAD7C00000-0x000001FAD7D00000-memory.dmp

Filesize
1024KB

Download
memory/1588-111-0x000001FAD7940000-0x000001FAD7A40000-memory.dmp

Filesize
1024KB

Download
memory/1588-102-0x000001FAD7940000-0x000001FAD7A40000-memory.dmp

Filesize
1024KB

Download
memory/1588-89-0x000001FAD7410000-0x000001FAD7510000-memory.dmp

Filesize
1024KB

Download
memory/1588-84-0x000001FAD7410000-0x000001FAD7510000-memory.dmp

Filesize
1024KB

Download
memory/1588-66-0x000001FAC6F40000-0x000001FAC6F42000-memory.dmp

Filesize
8KB

Download
memory/1588-64-0x000001FAC6F20000-0x000001FAC6F22000-memory.dmp

Filesize
8KB

Download
memory/1724-45-0x000001F044500000-0x000001F044600000-memory.dmp

Filesize
1024KB

Download
memory/5104-16-0x000002169E320000-0x000002169E330000-memory.dmp

Filesize
64KB

Download
memory/5104-35-0x000002169B6F0000-0x000002169B6F2000-memory.dmp

Filesize
8KB

Download
memory/5104-0-0x000002169E220000-0x000002169E230000-memory.dmp

Filesize
64KB

Download