umbral | cfb4919168697ab5bfaa045cbf2c647aa55c1ffc8f5109acf90f2e90af14f40a

Resubmissions

01-02-2024 15:13

240201-sl2ssaacgq 10

01-02-2024 15:00

240201-sdlrlaaagq 10

Analysis

max time kernel
104s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Promo link generator.exe
Size

228KB
MD5

4e711e7231a67ebf4278a6ba9e2a1f98
SHA1

9bc200a14d089e0fe869674ee5f4219e86dc3009
SHA256

cfb4919168697ab5bfaa045cbf2c647aa55c1ffc8f5109acf90f2e90af14f40a
SHA512

38ac5f01c19304431f1b862172fd0ed7b67fd8926c94e289a7a9b06a6772b02c7708f9ebeb3263269721d379dede458bd29d16fd6eb81eb500d85b202707ec0f
SSDEEP

6144:BloZMUrIkd8g+EtXHkv/iD409mMN5nsAv9R0STTKg/Yb8e1mIi:zoZrL+EP8gmMN5nsAv9R0STTKBm

Score

10^/10

umbral spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1196551286892535848/BI-4wJMe0VqcV998bhbMUu_wWa9MHqKDsvG2bhmZuynbA6FvVmQpf3BApw4_YqBZ6TZ5

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/memory/5028-0-0x000001CE67B40000-0x000001CE67B80000-memory.dmp	family_umbral
behavioral1/files/0x0003000000000715-143.dat	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Promo link generator.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Promo link generator.exe

Executes dropped EXE 1 IoCs

pid	Process
2164	Promo link generator.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
42	discord.com
108	discord.com
109	discord.com
41	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	ip-api.com
106	ip-api.com

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3332	wmic.exe
4996	wmic.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5084	PING.EXE
4688	PING.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
2972	powershell.exe
2972	powershell.exe
2972	powershell.exe
3860	powershell.exe
3860	powershell.exe
3860	powershell.exe
4372	identity_helper.exe
4372	identity_helper.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
1388	powershell.exe
1388	powershell.exe
1388	powershell.exe
608	powershell.exe
608	powershell.exe
608	powershell.exe
4996	msedge.exe
4996	msedge.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
588	powershell.exe
588	powershell.exe
588	powershell.exe
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3468	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	Promo link generator.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeIncreaseQuotaPrivilege	1544	wmic.exe
Token: SeSecurityPrivilege	1544	wmic.exe
Token: SeTakeOwnershipPrivilege	1544	wmic.exe
Token: SeLoadDriverPrivilege	1544	wmic.exe
Token: SeSystemProfilePrivilege	1544	wmic.exe
Token: SeSystemtimePrivilege	1544	wmic.exe
Token: SeProfSingleProcessPrivilege	1544	wmic.exe
Token: SeIncBasePriorityPrivilege	1544	wmic.exe
Token: SeCreatePagefilePrivilege	1544	wmic.exe
Token: SeBackupPrivilege	1544	wmic.exe
Token: SeRestorePrivilege	1544	wmic.exe
Token: SeShutdownPrivilege	1544	wmic.exe
Token: SeDebugPrivilege	1544	wmic.exe
Token: SeSystemEnvironmentPrivilege	1544	wmic.exe
Token: SeRemoteShutdownPrivilege	1544	wmic.exe
Token: SeUndockPrivilege	1544	wmic.exe
Token: SeManageVolumePrivilege	1544	wmic.exe
Token: 33	1544	wmic.exe
Token: 34	1544	wmic.exe
Token: 35	1544	wmic.exe
Token: 36	1544	wmic.exe
Token: SeIncreaseQuotaPrivilege	1544	wmic.exe
Token: SeSecurityPrivilege	1544	wmic.exe
Token: SeTakeOwnershipPrivilege	1544	wmic.exe
Token: SeLoadDriverPrivilege	1544	wmic.exe
Token: SeSystemProfilePrivilege	1544	wmic.exe
Token: SeSystemtimePrivilege	1544	wmic.exe
Token: SeProfSingleProcessPrivilege	1544	wmic.exe
Token: SeIncBasePriorityPrivilege	1544	wmic.exe
Token: SeCreatePagefilePrivilege	1544	wmic.exe
Token: SeBackupPrivilege	1544	wmic.exe
Token: SeRestorePrivilege	1544	wmic.exe
Token: SeShutdownPrivilege	1544	wmic.exe
Token: SeDebugPrivilege	1544	wmic.exe
Token: SeSystemEnvironmentPrivilege	1544	wmic.exe
Token: SeRemoteShutdownPrivilege	1544	wmic.exe
Token: SeUndockPrivilege	1544	wmic.exe
Token: SeManageVolumePrivilege	1544	wmic.exe
Token: 33	1544	wmic.exe
Token: 34	1544	wmic.exe
Token: 35	1544	wmic.exe
Token: 36	1544	wmic.exe
Token: SeIncreaseQuotaPrivilege	4936	wmic.exe
Token: SeSecurityPrivilege	4936	wmic.exe
Token: SeTakeOwnershipPrivilege	4936	wmic.exe
Token: SeLoadDriverPrivilege	4936	wmic.exe
Token: SeSystemProfilePrivilege	4936	wmic.exe
Token: SeSystemtimePrivilege	4936	wmic.exe
Token: SeProfSingleProcessPrivilege	4936	wmic.exe
Token: SeIncBasePriorityPrivilege	4936	wmic.exe
Token: SeCreatePagefilePrivilege	4936	wmic.exe
Token: SeBackupPrivilege	4936	wmic.exe
Token: SeRestorePrivilege	4936	wmic.exe
Token: SeShutdownPrivilege	4936	wmic.exe
Token: SeDebugPrivilege	4936	wmic.exe
Token: SeSystemEnvironmentPrivilege	4936	wmic.exe
Token: SeRemoteShutdownPrivilege	4936	wmic.exe
Token: SeUndockPrivilege	4936	wmic.exe
Token: SeManageVolumePrivilege	4936	wmic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3468	7zFM.exe
3468	7zFM.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1088	5028	Promo link generator.exe	95
PID 5028 wrote to memory of 1088	5028	Promo link generator.exe	95
PID 5028 wrote to memory of 2972	5028	Promo link generator.exe	98
PID 5028 wrote to memory of 2972	5028	Promo link generator.exe	98
PID 5028 wrote to memory of 3860	5028	Promo link generator.exe	102
PID 5028 wrote to memory of 3860	5028	Promo link generator.exe	102
PID 5028 wrote to memory of 3968	5028	Promo link generator.exe	108
PID 5028 wrote to memory of 3968	5028	Promo link generator.exe	108
PID 5028 wrote to memory of 1388	5028	Promo link generator.exe	111
PID 5028 wrote to memory of 1388	5028	Promo link generator.exe	111
PID 5028 wrote to memory of 1544	5028	Promo link generator.exe	115
PID 5028 wrote to memory of 1544	5028	Promo link generator.exe	115
PID 5028 wrote to memory of 4936	5028	Promo link generator.exe	119
PID 5028 wrote to memory of 4936	5028	Promo link generator.exe	119
PID 5028 wrote to memory of 4364	5028	Promo link generator.exe	121
PID 5028 wrote to memory of 4364	5028	Promo link generator.exe	121
PID 5028 wrote to memory of 608	5028	Promo link generator.exe	123
PID 5028 wrote to memory of 608	5028	Promo link generator.exe	123
PID 5028 wrote to memory of 3332	5028	Promo link generator.exe	125
PID 5028 wrote to memory of 3332	5028	Promo link generator.exe	125
PID 5028 wrote to memory of 4328	5028	Promo link generator.exe	129
PID 5028 wrote to memory of 4328	5028	Promo link generator.exe	129
PID 4328 wrote to memory of 5084	4328	cmd.exe	131
PID 4328 wrote to memory of 5084	4328	cmd.exe	131
PID 2164 wrote to memory of 2428	2164	Promo link generator.exe	145
PID 2164 wrote to memory of 2428	2164	Promo link generator.exe	145
PID 2164 wrote to memory of 3008	2164	Promo link generator.exe	147
PID 2164 wrote to memory of 3008	2164	Promo link generator.exe	147
PID 2164 wrote to memory of 3128	2164	Promo link generator.exe	149
PID 2164 wrote to memory of 3128	2164	Promo link generator.exe	149
PID 2164 wrote to memory of 1876	2164	Promo link generator.exe	151
PID 2164 wrote to memory of 1876	2164	Promo link generator.exe	151
PID 2164 wrote to memory of 588	2164	Promo link generator.exe	153
PID 2164 wrote to memory of 588	2164	Promo link generator.exe	153
PID 2164 wrote to memory of 4548	2164	Promo link generator.exe	155
PID 2164 wrote to memory of 4548	2164	Promo link generator.exe	155
PID 2164 wrote to memory of 1256	2164	Promo link generator.exe	157
PID 2164 wrote to memory of 1256	2164	Promo link generator.exe	157
PID 2164 wrote to memory of 3728	2164	Promo link generator.exe	159
PID 2164 wrote to memory of 3728	2164	Promo link generator.exe	159
PID 2164 wrote to memory of 4120	2164	Promo link generator.exe	161
PID 2164 wrote to memory of 4120	2164	Promo link generator.exe	161
PID 2164 wrote to memory of 4996	2164	Promo link generator.exe	163
PID 2164 wrote to memory of 4996	2164	Promo link generator.exe	163
PID 2164 wrote to memory of 4436	2164	Promo link generator.exe	165
PID 2164 wrote to memory of 4436	2164	Promo link generator.exe	165
PID 4436 wrote to memory of 4688	4436	cmd.exe	167
PID 4436 wrote to memory of 4688	4436	cmd.exe	167

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1088	attrib.exe
2428	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe6a8b46f8,0x7ffe6a8b4708,0x7ffe6a8b4718
1⤵
PID:2620

C:\Users\Admin\AppData\Local\Temp\Promo link generator.exe
"C:\Users\Admin\AppData\Local\Temp\Promo link generator.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Promo link generator.exe"
  2⤵
  - Views/modifies file attributes
  PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Promo link generator.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:608
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3332
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Promo link generator.exe" && pause
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
1⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
1⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
1⤵
PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
1⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
1⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
1⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
1⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3124 /prefetch:8
1⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3124 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
1⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
1⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
1⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
1⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
1⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1760 /prefetch:8
1⤵
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,1126185673540253420,7679470616529947985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Amruus promo link generator.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4936

C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe
"C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe"
  2⤵
  - Views/modifies file attributes
  PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:588
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:4548
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:1256
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4996
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe" && pause
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Promo link generator.exe.log

Filesize
1KB

MD5
547df619456b0e94d1b7663cf2f93ccb

SHA1
8807c99005eaf2cc44b0b5ec4fc6eac289bfb4e3

SHA256
8b7130cc966f3f78e236b4e51eb12e1c82b0bd3f0773275d619b5c545168797a

SHA512
01b4e32fdf6c7f2347075c8153bc75a2f32fe3cec19e1a777e263ec4f607b54e046f0e4c7c0bc22581d44cbbdbb076a63eaa50a742f381faad06c86c2b10f67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
ab6f83fbaeaa58512aadaf793c78007a

SHA1
7ebcbd577899eb98eb4accd53204ac0c10c154d2

SHA256
191b4d11fc0c5e7036196c8f59beccf54b200ea081e817be4bf1243ac618a133

SHA512
10f2fc7bbc26c5baf1424917bd9dc199907be766ad39884d970bc658febd4b0ae2d08d4706cbd9ee29c92e372a4abea77a6cc5e6b90959386a3c4de29f63f24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d9e1e768822562350fb1b43861bf8b35

SHA1
9b32b2e28a4c0cdfebe4c0e48dedb783d15f6b88

SHA256
733a73045cf98671a951bf3a40053993ddcb1edf2864e2c80d4516f1cc8a36b8

SHA512
3b1484072b1c52895e88927cbbbaaaf89698a87f27c2595a327dbdccf6b0991b47db68678685b7ae5dcfb04666881367d86365d97f5ff1f48a2d2bacfbdbb9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
3e481b4c0dc597992a9a3774d7f3bd2d

SHA1
aa72a43965f7a4b17e54e1bc6689eb63f31eac63

SHA256
64e78ceaa8b4550b9cb2a8ccdc0faaa8a810ac542eb83a3e96b862ffd90bd3bb

SHA512
ed56786d49870d198debf28ad2ed49712e6cd334315c992198994bb71a70a7b93e58888dd6c784d424a5fe17969763799fc8fc6967e4b0167206525a1fffd142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
04dba2e0763acb9b83dcb94ca0f4c2bd

SHA1
626394aea6be984d4817a88a591fea246bf4a362

SHA256
6590267fae391a722c4b8c759c88d9e694daac163148aad7e69faebe045b75e5

SHA512
1f0dff8f0a7d51ba949d994a6194eeb6d376da60769c0ea99d13c39242327a6bb5d4241b890ff0d29b17e39243b4ba1d9aa00ca952c54bbf13ea2abd95d1eb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7164c3d7c57ebbaec233482f2e1cc1f1

SHA1
a767f48a2a10c216470d0782100828f0bed91579

SHA256
65ca843513f0f6ee03ae9b357fd6fea801a17ffe23c8a04777f8f06a5f0206ae

SHA512
bc09ee737727408fa5a969a6eb2be0be83d521e4f3f6c0567e4caa28f09de2794d413fbef52a5a7243fb49005d69ab56052ce417440d07beadbc6684cb362951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
53d43051821fb792a8732dadd00cf11f

SHA1
bba86510189de501b8589a20f7b9618c3ec3bcaa

SHA256
b90ebbd6479c60160d4055377abf8fe2d2e076faefadf54499dab67f979e375b

SHA512
fa7c741be1b7bcc6e5c6a2c2857dfba12bd03514f9402652271e2209728c02d56d62159adedc6030c39a522c76c03f6a4ee1960e6eb75d9f240d297fbd29ee3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
bc051b3c05d1eb94762dce48e30f69d2

SHA1
014ec7fdc6303d58ead35afc65e186f9c66de9e2

SHA256
4849d78ba5085ee3c5fef729f8a6e1c6415333d4a3926370c681946a326c999b

SHA512
3d072c51513c71cd28897702dc380e2600a4c60f1d5b4ed59f6340c1f13270043e0a5c14b7aae0fa55a6fcd628456f69248aeb152027c9f6ee15179beb99992b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d3235ed022a42ec4338123ab87144afa

SHA1
5058608bc0deb720a585a2304a8f7cf63a50a315

SHA256
10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

SHA512
236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_by4x4lze.d4e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe

Filesize
228KB

MD5
4e711e7231a67ebf4278a6ba9e2a1f98

SHA1
9bc200a14d089e0fe869674ee5f4219e86dc3009

SHA256
cfb4919168697ab5bfaa045cbf2c647aa55c1ffc8f5109acf90f2e90af14f40a

SHA512
38ac5f01c19304431f1b862172fd0ed7b67fd8926c94e289a7a9b06a6772b02c7708f9ebeb3263269721d379dede458bd29d16fd6eb81eb500d85b202707ec0f

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/588-226-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/588-214-0x000001B2C81B0000-0x000001B2C81C0000-memory.dmp

Filesize
64KB

Download
memory/588-213-0x000001B2C81B0000-0x000001B2C81C0000-memory.dmp

Filesize
64KB

Download
memory/588-212-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/608-100-0x000001FF6DE20000-0x000001FF6DE30000-memory.dmp

Filesize
64KB

Download
memory/608-99-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/608-114-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/608-112-0x000001FF6DE20000-0x000001FF6DE30000-memory.dmp

Filesize
64KB

Download
memory/608-101-0x000001FF6DE20000-0x000001FF6DE30000-memory.dmp

Filesize
64KB

Download
memory/1388-91-0x000002C8A9580000-0x000002C8A9590000-memory.dmp

Filesize
64KB

Download
memory/1388-93-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/1388-78-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/1388-79-0x000002C8A9580000-0x000002C8A9590000-memory.dmp

Filesize
64KB

Download
memory/1388-80-0x000002C8A9580000-0x000002C8A9590000-memory.dmp

Filesize
64KB

Download
memory/1876-184-0x000002A3F1180000-0x000002A3F1190000-memory.dmp

Filesize
64KB

Download
memory/1876-211-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/1876-183-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/2164-185-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/2164-200-0x000002B9C6B00000-0x000002B9C6B10000-memory.dmp

Filesize
64KB

Download
memory/2164-147-0x000002B9C6B00000-0x000002B9C6B10000-memory.dmp

Filesize
64KB

Download
memory/2164-146-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/2972-6-0x0000019502280000-0x0000019502290000-memory.dmp

Filesize
64KB

Download
memory/2972-20-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/2972-17-0x0000019502280000-0x0000019502290000-memory.dmp

Filesize
64KB

Download
memory/2972-12-0x000001951A9C0000-0x000001951A9E2000-memory.dmp

Filesize
136KB

Download
memory/2972-5-0x0000019502280000-0x0000019502290000-memory.dmp

Filesize
64KB

Download
memory/2972-4-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/3008-159-0x000002827EBA0000-0x000002827EBB0000-memory.dmp

Filesize
64KB

Download
memory/3008-162-0x000002827EBA0000-0x000002827EBB0000-memory.dmp

Filesize
64KB

Download
memory/3008-148-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/3008-154-0x000002827EBA0000-0x000002827EBB0000-memory.dmp

Filesize
64KB

Download
memory/3008-164-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/3008-161-0x000002827EBA0000-0x000002827EBB0000-memory.dmp

Filesize
64KB

Download
memory/3128-177-0x0000020B4B900000-0x0000020B4B910000-memory.dmp

Filesize
64KB

Download
memory/3128-166-0x0000020B4B900000-0x0000020B4B910000-memory.dmp

Filesize
64KB

Download
memory/3128-180-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/3128-178-0x0000020B4B900000-0x0000020B4B910000-memory.dmp

Filesize
64KB

Download
memory/3128-165-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/3860-23-0x000001D1339F0000-0x000001D133A00000-memory.dmp

Filesize
64KB

Download
memory/3860-24-0x000001D1339F0000-0x000001D133A00000-memory.dmp

Filesize
64KB

Download
memory/3860-36-0x000001D1339F0000-0x000001D133A00000-memory.dmp

Filesize
64KB

Download
memory/3860-37-0x000001D1339F0000-0x000001D133A00000-memory.dmp

Filesize
64KB

Download
memory/3860-39-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/3860-22-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/3968-47-0x000001E13DA30000-0x000001E13DA40000-memory.dmp

Filesize
64KB

Download
memory/3968-46-0x000001E13DA30000-0x000001E13DA40000-memory.dmp

Filesize
64KB

Download
memory/3968-45-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/3968-77-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/4120-243-0x000002C976970000-0x000002C976980000-memory.dmp

Filesize
64KB

Download
memory/4120-238-0x000002C976970000-0x000002C976980000-memory.dmp

Filesize
64KB

Download
memory/4120-232-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/4120-245-0x000002C976970000-0x000002C976980000-memory.dmp

Filesize
64KB

Download
memory/4120-247-0x00007FFE597C0000-0x00007FFE5A281000-memory.dmp

Filesize
10.8MB

Download
memory/5028-96-0x000001CE6A020000-0x000001CE6A032000-memory.dmp

Filesize
72KB

Download
memory/5028-35-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/5028-119-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/5028-42-0x000001CE6A2E0000-0x000001CE6A356000-memory.dmp

Filesize
472KB

Download
memory/5028-3-0x000001CE6A090000-0x000001CE6A0A0000-memory.dmp

Filesize
64KB

Download
memory/5028-43-0x000001CE6A360000-0x000001CE6A3B0000-memory.dmp

Filesize
320KB

Download
memory/5028-44-0x000001CE698E0000-0x000001CE698FE000-memory.dmp

Filesize
120KB

Download
memory/5028-95-0x000001CE69FE0000-0x000001CE69FEA000-memory.dmp

Filesize
40KB

Download
memory/5028-1-0x00007FFE5A800000-0x00007FFE5B2C1000-memory.dmp

Filesize
10.8MB

Download
memory/5028-0-0x000001CE67B40000-0x000001CE67B80000-memory.dmp

Filesize
256KB

Download
memory/5028-58-0x000001CE6A090000-0x000001CE6A0A0000-memory.dmp

Filesize
64KB

Download