umbral | a6c6b2a4d581d6f5f1e661b0d0e390107ea79a7075700e48cfe41442c1e2eb06

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0aece04789b6892b13e1985bb08a7200.exe
Size

278KB
MD5

0aece04789b6892b13e1985bb08a7200
SHA1

49339cc3e987f517ab8ec2e6cb1baa19fbbc675f
SHA256

a6c6b2a4d581d6f5f1e661b0d0e390107ea79a7075700e48cfe41442c1e2eb06
SHA512

4d15c6bfd7c32f34fbbbb63cb4e974cd6f0d45f8f42605c4778cfb6dfccf527fa668717f70d955784e46899815a7a030cbe48616c0b93fe1825e80dfd5ca8b9d
SSDEEP

6144:pLGrA0UloZM9rIkd8g+EtXHkv/iD4ZZACl98e1mbix:eA0SoZOL+EP8h7n

Score

10^/10

umbral microsoft phishing spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1170536634891128902/hdNxkvpSxRXfW2ouud2imDE8eFbcAfoi3fBBxpcoRyxI8E-rxHT7NHLuI-Q-ThYq7M3H

Signatures

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000022e37-7.dat	family_umbral
behavioral2/files/0x0007000000022e37-8.dat	family_umbral
behavioral2/memory/1708-9-0x0000012423510000-0x0000012423550000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

Executes dropped EXE 2 IoCs

pid	Process
544	NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe
1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	ip-api.com

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe	NEAS.0aece04789b6892b13e1985bb08a7200.exe
File created	C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	NEAS.0aece04789b6892b13e1985bb08a7200.exe
File opened for modification	C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4876	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5360	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4164	powershell.exe
4164	powershell.exe
1612	powershell.exe
1612	powershell.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
2932	msedge.exe
2932	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
3440	identity_helper.exe
3440	identity_helper.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe
Token: SeManageVolumePrivilege	1056	wmic.exe
Token: 33	1056	wmic.exe
Token: 34	1056	wmic.exe
Token: 35	1056	wmic.exe
Token: 36	1056	wmic.exe
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe
Token: SeManageVolumePrivilege	1056	wmic.exe
Token: 33	1056	wmic.exe
Token: 34	1056	wmic.exe
Token: 35	1056	wmic.exe
Token: 36	1056	wmic.exe
Token: SeIncreaseQuotaPrivilege	1636	wmic.exe
Token: SeSecurityPrivilege	1636	wmic.exe
Token: SeTakeOwnershipPrivilege	1636	wmic.exe
Token: SeLoadDriverPrivilege	1636	wmic.exe
Token: SeSystemProfilePrivilege	1636	wmic.exe
Token: SeSystemtimePrivilege	1636	wmic.exe
Token: SeProfSingleProcessPrivilege	1636	wmic.exe
Token: SeIncBasePriorityPrivilege	1636	wmic.exe
Token: SeCreatePagefilePrivilege	1636	wmic.exe
Token: SeBackupPrivilege	1636	wmic.exe
Token: SeRestorePrivilege	1636	wmic.exe
Token: SeShutdownPrivilege	1636	wmic.exe
Token: SeDebugPrivilege	1636	wmic.exe
Token: SeSystemEnvironmentPrivilege	1636	wmic.exe
Token: SeRemoteShutdownPrivilege	1636	wmic.exe
Token: SeUndockPrivilege	1636	wmic.exe
Token: SeManageVolumePrivilege	1636	wmic.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 544	2904	NEAS.0aece04789b6892b13e1985bb08a7200.exe	88
PID 2904 wrote to memory of 544	2904	NEAS.0aece04789b6892b13e1985bb08a7200.exe	88
PID 2904 wrote to memory of 544	2904	NEAS.0aece04789b6892b13e1985bb08a7200.exe	88
PID 2904 wrote to memory of 1708	2904	NEAS.0aece04789b6892b13e1985bb08a7200.exe	92
PID 2904 wrote to memory of 1708	2904	NEAS.0aece04789b6892b13e1985bb08a7200.exe	92
PID 2904 wrote to memory of 4548	2904	NEAS.0aece04789b6892b13e1985bb08a7200.exe	93
PID 2904 wrote to memory of 4548	2904	NEAS.0aece04789b6892b13e1985bb08a7200.exe	93
PID 1708 wrote to memory of 3156	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	95
PID 1708 wrote to memory of 3156	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	95
PID 1708 wrote to memory of 4164	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	97
PID 1708 wrote to memory of 4164	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	97
PID 1708 wrote to memory of 1612	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	99
PID 1708 wrote to memory of 1612	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	99
PID 1708 wrote to memory of 4800	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	103
PID 1708 wrote to memory of 4800	1708	UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe	103
PID 544 wrote to memory of 2500	544	NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe	105
PID 544 wrote to memory of 2500	544	NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe	105
PID 2500 wrote to memory of 2568	2500	msedge.exe	106
PID 2500 wrote to memory of 2568	2500	msedge.exe	106
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 672	2500	msedge.exe	110
PID 2500 wrote to memory of 2932	2500	msedge.exe	109
PID 2500 wrote to memory of 2932	2500	msedge.exe	109
PID 2500 wrote to memory of 3828	2500	msedge.exe	112
PID 2500 wrote to memory of 3828	2500	msedge.exe	112
PID 2500 wrote to memory of 3828	2500	msedge.exe	112

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3156	attrib.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe
  C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffdf83746f8,0x7ffdf8374708,0x7ffdf8374718
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf83746f8,0x7ffdf8374708,0x7ffdf8374718
      4⤵
      PID:5396
- C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe
  C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:2220
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4612
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4876
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe" && pause
    3⤵
    PID:5260
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
6b06a74e7ba675b3b1990b830a3f69cc

SHA1
01e7cac0b6ee251f45c60728b494a9797fc0314d

SHA256
0e261368e4809ac4b5abf3bf2fe4a96e15b33e1d3956036f2e9219a6f138ce38

SHA512
0e807648ccae87ce80b8c0fe52668c84e03e6c397afa52e82a29dccd4a4e6a4bd4a596e39d2f9d978493ddf4c4fca832f6816650c4df642f19a513c5fae26179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c05e98178b3ba89179452865e3d145ab

SHA1
1915fc863198fd1b97ceeb5bc93217cbe865ec8d

SHA256
36c04a58f5e7f9de40167235250b95162ba4ef8845fac69f2899308cecce163f

SHA512
edca7392608d51e311662e7ec53b98e004b4079548e970ee5446c977eed2a12016bc7cd504f8213adfa68c3aeea37a4ed3127c406994a4e4361e469808821d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc66eee5cf4322cd483336729d4d5b43

SHA1
1c9bf43130a416e9df92266663563e86bb5c6038

SHA256
be061cf3813ef2bfeea73023f944f408da1d4e3b456ba386b79b88b89b5b170e

SHA512
51ad8dd043397998382f4682ffc59be6dddbf0d72e9918ea21aa9d168189cd272303a5f5472102a9f377f560a3ab3a95fa62a2baa65cf2c86c4e9d802621389f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
66f75213b5ac341d00b947f7ee3ccf30

SHA1
36acf1a510d234f3aeb0106f8e9d26cc0d31bb04

SHA256
d73841c10cb8c3019dcb2ed7a8eb2b820629f555e7f1f0cfde43bd27e5a4c1ea

SHA512
62a64bf1b74ae2d204a5c3ae7ddd939f743b0e4ec807bef6c7aa5101e4c4c03789849973941bafd0c0a550d263eeacf95d688fb1b9314c2411f5cc8170665eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
fe158205119cc2752be4249ac6d5efe1

SHA1
74bc3f31434c770e1b0f249b06e530d49ecf88e4

SHA256
2000d0a71647d579811e2930d5f3c49076a7f992c747a3cbfc57c4c96e364c57

SHA512
063ac46013074924dcba3e930ebd4a7d0150418931d00ff0b4f9b660f47ae7edf4f39494543ab1ec7fbb0cb34cf0cbc10825e6b0fe93addfaee449cefafab639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586a6d.TMP

Filesize
371B

MD5
96c296b7b770ba4a64a8fe9707724a68

SHA1
7475e3baf3541035da8535f15b343ac4174a33f9

SHA256
875f2d5d293dc3cd01e8f2c358c64632f5cd1c372310f035df17085e8975a04d

SHA512
f3ac60897a7e9e3b02cc6c4ef5b3c5cc44a001741efac538d7788fd9e0d26d0651c728e52a84bc1c9402a8b39fec2b5f0555e325fbd23c03c4e89eabb9791613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e0f3494cd4c13d42d4e138367c14741

SHA1
4a4bc8d47cf6025c33fd94b26fec678b5ca60818

SHA256
1adb1fc8f416c6ac941d79642036dc56316b72f4cceadf1841e9c3206ec18ad0

SHA512
361539be5d2486ce933a9156d030cba6bf02b9ce38f1441d50d3106063bca7e7a5eb6db0efad6504d51cde51c55139cbb9f7d73dfc0cb2138b40b54294a4547b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
da02a95b169ee0507779be78fc534652

SHA1
008a0f04246f51ef4fc3ed824e92a1118bc787e4

SHA256
dd74047461f8e3faf2c82cfa546ee3791f9b157b4055e5a7a04a194f5c25ce2e

SHA512
014d0011d0dddac0c25835dc0b332268cea1ab9acb4ecb753cf5b261c0600f541b0716751a11a2fe22e48c36692b96c0d22185f6ebb84ae90758ea412185e28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1fabe117b9df3e717a1a47eea4ab315d

SHA1
8cf9173bbc9a86f33abd6219eaf6956da55cd080

SHA256
b35e27b7e9fbdf2096563e70e59d299b9354d34668e50cfd7cebb3a870d92c0b

SHA512
936a10b3d8685c5f3817b6d32ca262e262a104dc16b036c4a92d91ea60cf8be221a2a2121cf040a0fb470d76e779ba9ce4e82b42a075b365b1e2fdb782171a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
df6c4e5c3091c14551e6c92f07717617

SHA1
1ea87111035496c1b2b74cef8b5c62d00ac072c9

SHA256
b79dc75372707ff84a643a9e4cff6fad2d1a936b54d458088850c62c96e2f231

SHA512
ab861efd0ff28a4bae3513a884d5b00c1b68d8f0bd54a00428bbb65a6954f8778e8f5300362025265251cb425c5ed77608b10776f382c3b392916ae46e38db35

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0uwkk52c.mgx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe

Filesize
11KB

MD5
cebf7458dceffcbb81a290cf045beb27

SHA1
98c74fa610995d61d2ee78a2ea888e003e9f436d

SHA256
97d22321ba783bf6d2119320d38d776bbc6bef42fe3dadecf512e23bbdd29660

SHA512
144f0da1e8060e08340f1b349f7bbb17be298ee3d27d056d5603143125b8a9d7abb9485d0f5a2a26e2e50f0d5970ecf5fc3a9e665eece70414c6dc1504b04a91

Download Submit
C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

Filesize
227KB

MD5
ef2711e9aeeb23297016ef32b46a3c7e

SHA1
ba51f478c1118d7803620367cb97ce2ceba52a5a

SHA256
2fe65b8585389b60e44f688f755bbaefe5a3689737050a96c7586bd9b69a9759

SHA512
3c5453a308f0f8321141c2949540f7c3a7c9774eb9e8767210ee30e9745caee0e8bafa8806736f1ec04bd952aa411a5a38a6c97fe19bea3d8d86729571a7059f

Download Submit
C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

Filesize
227KB

MD5
ef2711e9aeeb23297016ef32b46a3c7e

SHA1
ba51f478c1118d7803620367cb97ce2ceba52a5a

SHA256
2fe65b8585389b60e44f688f755bbaefe5a3689737050a96c7586bd9b69a9759

SHA512
3c5453a308f0f8321141c2949540f7c3a7c9774eb9e8767210ee30e9745caee0e8bafa8806736f1ec04bd952aa411a5a38a6c97fe19bea3d8d86729571a7059f

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/1612-30-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/1612-46-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/1612-31-0x0000028942110000-0x0000028942120000-memory.dmp

Filesize
64KB

Download
memory/1612-43-0x0000028942110000-0x0000028942120000-memory.dmp

Filesize
64KB

Download
memory/1612-44-0x0000028942110000-0x0000028942120000-memory.dmp

Filesize
64KB

Download
memory/1708-191-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/1708-149-0x000001243DD70000-0x000001243DD7A000-memory.dmp

Filesize
40KB

Download
memory/1708-49-0x000001243DD90000-0x000001243DE06000-memory.dmp

Filesize
472KB

Download
memory/1708-50-0x000001243DD10000-0x000001243DD60000-memory.dmp

Filesize
320KB

Download
memory/1708-9-0x0000012423510000-0x0000012423550000-memory.dmp

Filesize
256KB

Download
memory/1708-10-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/1708-11-0x000001243DAB0000-0x000001243DAC0000-memory.dmp

Filesize
64KB

Download
memory/1708-51-0x00000124252A0000-0x00000124252BE000-memory.dmp

Filesize
120KB

Download
memory/1708-190-0x000001243DAC0000-0x000001243DBC2000-memory.dmp

Filesize
1.0MB

Download
memory/1708-32-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/1708-150-0x000001243EC00000-0x000001243EC12000-memory.dmp

Filesize
72KB

Download
memory/1708-161-0x000001243DAC0000-0x000001243DBC2000-memory.dmp

Filesize
1.0MB

Download
memory/4164-18-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/4164-19-0x00000269731E0000-0x00000269731F0000-memory.dmp

Filesize
64KB

Download
memory/4164-20-0x00000269731E0000-0x00000269731F0000-memory.dmp

Filesize
64KB

Download
memory/4164-25-0x00000269731E0000-0x00000269731F0000-memory.dmp

Filesize
64KB

Download
memory/4164-28-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/4164-17-0x000002695ABE0000-0x000002695AC02000-memory.dmp

Filesize
136KB

Download
memory/4260-138-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/4260-113-0x0000025EA54A0000-0x0000025EA54B0000-memory.dmp

Filesize
64KB

Download
memory/4260-112-0x0000025EA54A0000-0x0000025EA54B0000-memory.dmp

Filesize
64KB

Download
memory/4260-111-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/4612-177-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/4612-175-0x0000013629E00000-0x0000013629E10000-memory.dmp

Filesize
64KB

Download
memory/4612-174-0x0000013629E00000-0x0000013629E10000-memory.dmp

Filesize
64KB

Download
memory/4612-173-0x0000013629E00000-0x0000013629E10000-memory.dmp

Filesize
64KB

Download
memory/4612-172-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/4800-53-0x00000212EDDE0000-0x00000212EDDF0000-memory.dmp

Filesize
64KB

Download
memory/4800-54-0x00000212EDDE0000-0x00000212EDDF0000-memory.dmp

Filesize
64KB

Download
memory/4800-52-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download
memory/4800-90-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

Filesize
10.8MB

Download