healer | 106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34

max time kernel
72s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2023 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
Size

1.2MB
MD5

5b3b6822964b4151c6200ecd89722a86
SHA1

ce7a11dae532b2ade1c96619bbdc8a8325582049
SHA256

106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34
SHA512

2f0d99af35c326cf46810c7421325deb55ae7ca36a8edc2716a3d32d9e6769e0d374581a98912e22fceeb6973e972463ed8b2fa4d4399043c443fa100dfd17b0
SSDEEP

24576:5yY4YriuQJ5X4SuIcmuBLahxwUzN1YyqoVKucvTNLF9:sY4FuIahGxRMoobNLF

Score

10^/10

healer redline ronur dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ronur

193.233.20.20:4134

Attributes

auth_value
f88f86755a528d4b25f6f3628c460965

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000022e5c-33.dat	healer
behavioral1/files/0x0007000000022e5c-34.dat	healer
behavioral1/memory/4780-35-0x00000000006D0000-0x00000000006DA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	iwN36Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	iwN36Rn.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/4084-93-0x0000000004AF0000-0x0000000004B36000-memory.dmp	family_redline
behavioral1/memory/4084-97-0x0000000005150000-0x0000000005194000-memory.dmp	family_redline
behavioral1/memory/4084-103-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-104-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-106-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-108-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-110-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-121-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-130-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-132-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-136-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-138-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-142-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-144-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-146-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-148-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-151-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-165-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-167-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-171-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-176-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-186-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-188-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-199-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-201-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-206-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-208-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-212-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-217-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-223-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-230-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-233-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-235-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-237-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/4084-239-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
5092	sbO31En07.exe
4984	smS09II74.exe
936	slc39Ad82.exe
1144	sko86jV13.exe
4780	iwN36Rn.exe
4084	kLG98Ei.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	iwN36Rn.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	sko86jV13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sbO31En07.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	smS09II74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	slc39Ad82.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	SystemSettingsAdminFlows.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	SystemSettingsAdminFlows.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	SystemSettingsAdminFlows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	SystemSettingsAdminFlows.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	SystemSettingsAdminFlows.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350690463-3549324357-1323838019-1000\{629E097B-3B08-4FA1-A4BD-0D09631FD600}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4780	iwN36Rn.exe
4780	iwN36Rn.exe
2388	msedge.exe
2388	msedge.exe
1644	msedge.exe
1644	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
3736	msedge.exe
3736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	iwN36Rn.exe
Token: SeDebugPrivilege	4084	kLG98Ei.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4472	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 5092	2588	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	85
PID 2588 wrote to memory of 5092	2588	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	85
PID 2588 wrote to memory of 5092	2588	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	85
PID 5092 wrote to memory of 4984	5092	sbO31En07.exe	86
PID 5092 wrote to memory of 4984	5092	sbO31En07.exe	86
PID 5092 wrote to memory of 4984	5092	sbO31En07.exe	86
PID 4984 wrote to memory of 936	4984	smS09II74.exe	88
PID 4984 wrote to memory of 936	4984	smS09II74.exe	88
PID 4984 wrote to memory of 936	4984	smS09II74.exe	88
PID 936 wrote to memory of 1144	936	slc39Ad82.exe	89
PID 936 wrote to memory of 1144	936	slc39Ad82.exe	89
PID 936 wrote to memory of 1144	936	slc39Ad82.exe	89
PID 1144 wrote to memory of 4780	1144	sko86jV13.exe	90
PID 1144 wrote to memory of 4780	1144	sko86jV13.exe	90
PID 1644 wrote to memory of 2140	1644	msedge.exe	98
PID 1644 wrote to memory of 2140	1644	msedge.exe	98
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 4932	1644	msedge.exe	100
PID 1644 wrote to memory of 2388	1644	msedge.exe	101
PID 1644 wrote to memory of 2388	1644	msedge.exe	101
PID 1644 wrote to memory of 3276	1644	msedge.exe	102
PID 1644 wrote to memory of 3276	1644	msedge.exe	102
PID 1644 wrote to memory of 3276	1644	msedge.exe	102
PID 1644 wrote to memory of 3276	1644	msedge.exe	102
PID 1644 wrote to memory of 3276	1644	msedge.exe	102
PID 1644 wrote to memory of 3276	1644	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
"C:\Users\Admin\AppData\Local\Temp\106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe88a746f8,0x7ffe88a74708,0x7ffe88a74718
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3904211428277778730,11401632566121227655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EnterProductKey
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
51c2f45a39fb8047fcde6d3c18812572

SHA1
4462c16660cb9321e3d2915dfc8c697b9d184973

SHA256
b2edb7cf8ddf41003fb1d342fb9c948ca78aed943512db42dafc843e553c47b4

SHA512
228aed4cb6959a9557ef6aa4d4b39fe9774b9045499b934abd73829bfe2be4dfeaab9b9237608e9b1e069f6d57af7d5db2101be55615c9fa73f08754af332e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43beee58ec15f6046fb100f74e0d0ced

SHA1
26bd9eb66948b863c7f9c0af0fba96c54f7b15e3

SHA256
9a590c34fd28d8a94424a1961753e408b908c5b5334205539645bd5f3edfa842

SHA512
13e1582044b1f1d21951ee5633cd200f379de6674bb76c612d830497c4908867d99150458fc114a6f47fd22800b9ac3c26702c2c031e30d73c39005ec61b0108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7e218b02ca9a4283451d710aac62c41

SHA1
2ad2892cc80bcf34eacc2a4c6a4f1eb953b96d1e

SHA256
48155d4ec1db23c8a4b30c9afae65a00639817fc78c919235f429fb456bbeeb1

SHA512
e3dbc5da608047d43ead38645ffebf0d6dbe9eb082e0f16203ac6fe0f234ccc389c54258f9dfa18b563abb8d6ccc6ba87de80e1aaf012b54174daac10470aecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d820466f69cfab2ef4bd0362797430ce

SHA1
27b3e57343df2668f073f51ee81499bdd458b204

SHA256
f1012e4ab28c625780eb79d67fbaf5a7ed6561f36f196a5f3bc65577f6c90b01

SHA512
6ad2df7ae6b66b6743cb3c91925405d141a54588ac92d15721ff487c731fbb1361e974806d94d8d3a3b8e90df21a28e50f5f1f679456deb0b915db4c2eeeb2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f56988feddc44982e08e80e8c9a074b9

SHA1
ff7c8036ede65c91f197b2d2115827fb81d0e97b

SHA256
ebc23ec4d1251397536eb77d374b4e576a210495e962b834f878aa666674a1e0

SHA512
eea6ff1527ac5b7c3ac2797aa9241c602acde66015eeefec1fe1648e9417c7a090188aa8d175146921d8503528aba2178a505e57800d860c4f836fa42a3518d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6bc1853a2fc5147cfb3378a4b2c7ece

SHA1
f4f40ee6b528c95c27eea274edda9eff76654a09

SHA256
a925fbbac0595e0e66c20e76e086525e6cd130655d64a92a99c3109972e3a705

SHA512
f41ea76a6386240fa6c6a85919cb0ce4db4d87618dbf688fea71b9381e0219c4c341122c8b5b930732b13fcccf13bac3bc00a946b17957882b8eccf200fa3737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
018f9bca10b1dcb08d24cf394044fcc3

SHA1
87dc9868d490955c89a00d3aff7d8cd1b91cfea9

SHA256
340e3506867a386db9d2ab6b752cdba876d0a628389abc810c445e9cfb8615d8

SHA512
9e119063a509c48404bdb547e373e7eee7ad2896523d54d12b0523864bac95cdaa3d699aef0bbb56342f51dc141d4bb2b8957dd35034bbae74e0f0ddeab2edad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe

Filesize
1010KB

MD5
f8d3a0a73fbee1e94dcd0fedf9a31c4e

SHA1
71ef31102516e25e3b3aa347b5c697a85d237b16

SHA256
ad974386b5f8a42a0ff8d77d4f6e1919f2bfbe3f4008320acb1bc327e6f4947c

SHA512
81337186639f964ed048b288be37575ffaa989d9d6c6a91a27db8d6bfe5c4fb42f11d63ab32008e485f921bcb774304a6f96cb4e17778dcc38f1e4b072deca28

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe

Filesize
1010KB

MD5
f8d3a0a73fbee1e94dcd0fedf9a31c4e

SHA1
71ef31102516e25e3b3aa347b5c697a85d237b16

SHA256
ad974386b5f8a42a0ff8d77d4f6e1919f2bfbe3f4008320acb1bc327e6f4947c

SHA512
81337186639f964ed048b288be37575ffaa989d9d6c6a91a27db8d6bfe5c4fb42f11d63ab32008e485f921bcb774304a6f96cb4e17778dcc38f1e4b072deca28

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe

Filesize
869KB

MD5
5739bc2cafd62977daa950a317be8d14

SHA1
f7f582e1863642c4d5a8341e2005c06c0f3d9e74

SHA256
b3cad94dc96473ea46e9af91de2a2126ee2345d47a2d1a926182db447de2ecc9

SHA512
f55320fdf0383e3c7f8a9841c3444b58f9551d879d89ad1ee44388e9621b4b5f0f7e504915012e3acf24b3aa45a3d0f1e692ddee89a38d3987f95fe97d5bae8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe

Filesize
869KB

MD5
5739bc2cafd62977daa950a317be8d14

SHA1
f7f582e1863642c4d5a8341e2005c06c0f3d9e74

SHA256
b3cad94dc96473ea46e9af91de2a2126ee2345d47a2d1a926182db447de2ecc9

SHA512
f55320fdf0383e3c7f8a9841c3444b58f9551d879d89ad1ee44388e9621b4b5f0f7e504915012e3acf24b3aa45a3d0f1e692ddee89a38d3987f95fe97d5bae8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe

Filesize
651KB

MD5
e12e7b53183d3b1c6cd53ef42aa815f8

SHA1
9dedb739590a02e37c82e54cc8eb3e0ce57248ee

SHA256
63ac9bdbd61a661f5bc96825ad4408df1312b18f455472b63c66f6e5efb05e63

SHA512
5e4a61453476d524cf3b96743e2f5163c01f3ae1d8f05653d9ed3ffd0614b43afa013554e6c0b0294763e80beca5081fc088ad6e595a2af67115a62f4cce410c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe

Filesize
651KB

MD5
e12e7b53183d3b1c6cd53ef42aa815f8

SHA1
9dedb739590a02e37c82e54cc8eb3e0ce57248ee

SHA256
63ac9bdbd61a661f5bc96825ad4408df1312b18f455472b63c66f6e5efb05e63

SHA512
5e4a61453476d524cf3b96743e2f5163c01f3ae1d8f05653d9ed3ffd0614b43afa013554e6c0b0294763e80beca5081fc088ad6e595a2af67115a62f4cce410c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe

Filesize
383KB

MD5
7c29db2ac66b846cc00ca802838c116b

SHA1
23f9d79f7cf7d5fb41111bf4896645d3989b4f11

SHA256
e4519665ce98d8426aceadad26a6bbe92b455f59f6261a8240dcba5b40e6a51b

SHA512
a46c3d3a3e7ff2ae24cf67eed51367cd5b422cc793911d59de19d2ba0c763c29f569b9876ef41ad74ec3e9977ab280100c09755abdc6908e269bce4a1b761cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe

Filesize
383KB

MD5
7c29db2ac66b846cc00ca802838c116b

SHA1
23f9d79f7cf7d5fb41111bf4896645d3989b4f11

SHA256
e4519665ce98d8426aceadad26a6bbe92b455f59f6261a8240dcba5b40e6a51b

SHA512
a46c3d3a3e7ff2ae24cf67eed51367cd5b422cc793911d59de19d2ba0c763c29f569b9876ef41ad74ec3e9977ab280100c09755abdc6908e269bce4a1b761cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe

Filesize
275KB

MD5
ef9dd5707f37f0e2f802b3d7856e7bbc

SHA1
e9cbeca90f2edece7174b0fcffe65f311b5b3689

SHA256
de4cdd6ab46f28034be20c1a3231035ac3dc1aafbb443e0ccaaadd3ccdf0fadf

SHA512
24d042eb4715e4a9ed98609fe264bbd1aded094c2efa410e59a3bd800fc36561242c1433e8573de9581bea6e38b9f269dcd6b2eba20e4548e5cdd893c9334b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe

Filesize
275KB

MD5
ef9dd5707f37f0e2f802b3d7856e7bbc

SHA1
e9cbeca90f2edece7174b0fcffe65f311b5b3689

SHA256
de4cdd6ab46f28034be20c1a3231035ac3dc1aafbb443e0ccaaadd3ccdf0fadf

SHA512
24d042eb4715e4a9ed98609fe264bbd1aded094c2efa410e59a3bd800fc36561242c1433e8573de9581bea6e38b9f269dcd6b2eba20e4548e5cdd893c9334b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe

Filesize
275KB

MD5
ef9dd5707f37f0e2f802b3d7856e7bbc

SHA1
e9cbeca90f2edece7174b0fcffe65f311b5b3689

SHA256
de4cdd6ab46f28034be20c1a3231035ac3dc1aafbb443e0ccaaadd3ccdf0fadf

SHA512
24d042eb4715e4a9ed98609fe264bbd1aded094c2efa410e59a3bd800fc36561242c1433e8573de9581bea6e38b9f269dcd6b2eba20e4548e5cdd893c9334b44

Download Submit
memory/4084-233-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-1189-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4084-97-0x0000000005150000-0x0000000005194000-memory.dmp

Filesize
272KB

Download
memory/4084-95-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4084-103-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-104-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-106-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-108-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-93-0x0000000004AF0000-0x0000000004B36000-memory.dmp

Filesize
280KB

Download
memory/4084-110-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-121-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-94-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4084-130-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-132-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-136-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-138-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-142-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-144-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-146-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-148-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-151-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-165-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-167-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-171-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-176-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-186-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-188-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-199-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-201-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-206-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-208-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-212-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-217-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-223-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-230-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-92-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4084-235-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-237-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-239-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/4084-91-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download
memory/4084-1142-0x0000000005300000-0x0000000005918000-memory.dmp

Filesize
6.1MB

Download
memory/4084-1143-0x00000000059A0000-0x0000000005AAA000-memory.dmp

Filesize
1.0MB

Download
memory/4084-1148-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4084-1147-0x0000000005AE0000-0x0000000005AF2000-memory.dmp

Filesize
72KB

Download
memory/4084-1151-0x0000000005C00000-0x0000000005C3C000-memory.dmp

Filesize
240KB

Download
memory/4084-1163-0x0000000005C50000-0x0000000005C9C000-memory.dmp

Filesize
304KB

Download
memory/4084-90-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/4084-1177-0x0000000000670000-0x0000000000770000-memory.dmp

Filesize
1024KB

Download
memory/4084-1188-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download
memory/4084-96-0x0000000004B60000-0x0000000005104000-memory.dmp

Filesize
5.6MB

Download
memory/4084-89-0x0000000000670000-0x0000000000770000-memory.dmp

Filesize
1024KB

Download
memory/4084-1196-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4084-1197-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4084-1216-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4472-1286-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1224-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1221-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1292-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1228-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1226-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1239-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1241-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1243-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1245-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1247-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1253-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1255-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1259-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1261-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1290-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1265-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1269-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1271-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1288-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1353-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1355-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1263-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1294-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1298-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1302-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1304-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1300-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1308-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1306-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1310-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1313-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1329-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1333-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1337-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1335-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1331-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1339-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1349-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4472-1351-0x0000020887F10000-0x0000020887F20000-memory.dmp

Filesize
64KB

Download
memory/4780-36-0x00007FFE8D310000-0x00007FFE8DDD1000-memory.dmp

Filesize
10.8MB

Download
memory/4780-35-0x00000000006D0000-0x00000000006DA000-memory.dmp

Filesize
40KB

Download
memory/4780-84-0x00007FFE8D310000-0x00007FFE8DDD1000-memory.dmp

Filesize
10.8MB

Download