hxxp://qamia[.]com

General

Target

http://qamia.com

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
2968	powershell.exe
2968	powershell.exe
4960	msedge.exe
4960	msedge.exe
2300	msedge.exe
2300	msedge.exe
4212	msedge.exe
4212	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2968 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exemsedge.exe

description	pid	process	target process
PID 4580 wrote to memory of 3376	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 3376	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 1412	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 2300	4580	msedge.exe	msedge.exe
PID 4580 wrote to memory of 2300	4580	msedge.exe	msedge.exe
PID 4172 wrote to memory of 5032	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 5032	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe
PID 4172 wrote to memory of 1676	4172	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://qamia.com
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://qamia.com
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa137f46f8,0x7ffa137f4708,0x7ffa137f4718
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,18426153162554868746,10799758070840286651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,18426153162554868746,10799758070840286651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
1⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffa137f46f8,0x7ffa137f4708,0x7ffa137f4718
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14503572087223373888,6416283542113622284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14503572087223373888,6416283542113622284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1436 /prefetch:1
1⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1
1⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
1⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5960 /prefetch:8
1⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6380 /prefetch:8
1⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
1⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6024 /prefetch:2
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
1⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
1⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5314660205711575654,13959273218302608815,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
1⤵
PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
f7144a5599e49b5b444b035a0ca0bab6

SHA1
9f3c1f837c2c41200e9208ea05aad06a0778db00

SHA256
ccde0ee17579835a9d49f814563dd83df8f4ba58ca66e15deba8507d38f08cda

SHA512
c5ebc5174027bc89bf0aac590738d2bc857285207f17062f97f5e0f1e2a280bc8a8a2c9321b2bea8a6b4da09522299d73f38c3aaf351d7a8586406ab02c3042f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
442B

MD5
0ea3b09703b224724a3570e904a12fcb

SHA1
d74dcc8c4fca1616546e25d10665b9b337b6ab98

SHA256
34e6b97fcd2fe4b19b644b1eddd1e0f0df0d939533a5d367109dcd1cde4e0756

SHA512
d7e119b4b5f17d460ec78c655169e2d30f2f149a02f75490648d1aaeed2e1d4b61df4cac1081c316087ce5bd690c66039e8bb93dc061144d8e74c3069cc480cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
18ad3a99cbd5ddc6b806e98374137f92

SHA1
03b6e4402a81fc0585430539a6d4a208b6ca9020

SHA256
b4f8afdb8ec7975ab4f4bff3a5c1fcab389dee2b9eb38b9603099d500457145f

SHA512
faabf3e957ee6516f8e66a1decfb2279e3923f63d0bc3f4f6aa5082b84feba57e48d0c631800b962567313b26d6cb92192a29eef6faf7b0be01894233b4929b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
af5c786a9b7ad9e34ab9399ad8cf47de

SHA1
6a4ae7ba1c6a95edb977e4a9b98b21d72eac1f75

SHA256
0a9bbe6e40614e71b6fa5c2934879999bc3e4ea7fbd2d7a1dc1b988455b2b9dd

SHA512
d17abeac04fd2f821994a06f97cc327a7fa243e96921d1547a14650dece97050b4aa8ca070fcb017ab2575593b990ead06af3a2190eb138e830a6c917f2349b0

Download Submit
\??\pipe\LOCAL\crashpad_4172_PJBTLQXFVYJPQQHF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4580_EQFLHEVZUHUAVCDP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1412-136-0x0000000000000000-mapping.dmp

Download
memory/1676-144-0x0000000000000000-mapping.dmp

Download
memory/2300-137-0x0000000000000000-mapping.dmp

Download
memory/2968-139-0x00007FFA11870000-0x00007FFA12331000-memory.dmp

Filesize
10.8MB

Download
memory/2968-132-0x0000021729A40000-0x0000021729A62000-memory.dmp

Filesize
136KB

Download
memory/2968-134-0x00007FFA11870000-0x00007FFA12331000-memory.dmp

Filesize
10.8MB

Download
memory/3376-133-0x0000000000000000-mapping.dmp

Download
memory/4212-145-0x0000000000000000-mapping.dmp

Download
memory/5032-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing