hxxps://github[.]com/l4tt-byfron/Electron/releases

Analysis

max time kernel
190s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/l4tt-byfron/Electron/releases

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\객げ☀耀\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\.md	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\md_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\객げ☀耀	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
5100	msedge.exe
5100	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
1240	msedge.exe
1240	msedge.exe
1356	msedge.exe
1356	msedge.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
4028	msedge.exe
4028	msedge.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2416	msedge.exe
2416	msedge.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4184	OpenWith.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	3864	7zFM.exe
Token: 35	3864	7zFM.exe
Token: SeRestorePrivilege	1236	7zFM.exe
Token: 35	1236	7zFM.exe
Token: SeRestorePrivilege	2644	7zFM.exe
Token: 35	2644	7zFM.exe
Token: SeDebugPrivilege	2108	taskmgr.exe
Token: SeSystemProfilePrivilege	2108	taskmgr.exe
Token: SeCreateGlobalPrivilege	2108	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe
2108	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe
4184	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4052	1036	msedge.exe	66
PID 1036 wrote to memory of 4052	1036	msedge.exe	66
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 4668	1036	msedge.exe	85
PID 1036 wrote to memory of 5100	1036	msedge.exe	86
PID 1036 wrote to memory of 5100	1036	msedge.exe	86
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87
PID 1036 wrote to memory of 4644	1036	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/l4tt-byfron/Electron/releases
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91a6e46f8,0x7ff91a6e4708,0x7ff91a6e4718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Electron.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Electron.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Electron.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,13098266977373612289,11862244289933918796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Electron-Electron.zip\Electron-Electron\README.md
  2⤵
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ffd05f09ab9a91ecbb01e0bc959cccd0

SHA1
84b83d9de609523c987c07035c1df8dda40a6e65

SHA256
93ead04e1ea98a5fbd360bea6f767a288fe5b7cd28c0d1d6873bd511a3910027

SHA512
cc71091338bbed7b79bb145747a83d98c14314f22f15e79ebef94a57f7adf8389c3ca15d1db46b5124e6fe68ebd7909fab28ce8bcda95a282176dd9fb4656181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
400254bc74a940e106ef367c6d86b29d

SHA1
6868b379c43d1e7afb4f734922451768bb73b579

SHA256
545504b1d8e2aa9643ef341737938d9dfb25c195040529a02024180e9c2ddbe1

SHA512
aa5d1d47b172ee28efdbae8621446360b67a72d10a12e595a00123d66b95935aba054fe2018c676717799a5d0886802fdca4e5ca1fced462c143519e70a58bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b13f93893a40a263af07dc4740cd6c7

SHA1
4cbad15a7372dd56f77a391936ec8e1656c0ec48

SHA256
c586887fb84d0004e214d68b24bdc9564b2fcbd59b2ed380f6b321ecf2badd71

SHA512
7964f0590726f7fe4b815631220b06483be43677b2d47db139216fd4f75b24e2a7f892999a9e07d7e758612d7df1e806f8877169f15ebb0c45b8a370fe2be4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b333ea94c2c48aeea5780c0b3e98e9f7

SHA1
c87aed44ffd2e5f68e4c384bf018a916b4ed070c

SHA256
88f1302cfb9c5adc72e18fbfedffcfdaf531a9ad95a1bd3932091e54893a654b

SHA512
7bb475d5ae78d75d21c588350328585ad610cd940ba531368aa001c6b9d5750d4bd83fcf21ff0fa1893689f31b6ec2010a14e369e7d4880e108fefd941d3ddb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60a179cb60bb26957103ac81923ea89d

SHA1
ea5df4e8ebb5139a1219a45d1c84424f5d80abab

SHA256
c5fa90193ae275e2823f8fe3eb9c1f45fd43a9d4f0d8062f3db41aa0337c278f

SHA512
5d045895f6e19d91c2cab00057f23cfc8c0715a9c68b7a9a19fa2ba06ae7a107556ad07fdefc92fc6072add1bb29a83513af6e5f437c55eb5ee20b3259f80478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd747f64a53fb5bb83d70a913a739135

SHA1
a96d5c07e223a58bb860a0245966e5a4cba70e63

SHA256
f50a69656c2c56e4863a0a73adde116eabadeb4a1dba222879079b1efd15542f

SHA512
509760d7ac20229f39de3ba00fddc371cf909272a87090480e47590cea7c58f69112ceb27c42c608f8eb8be5e886405d42775c2b1314ddad5ee73e8e2f0cee1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58f8f207708b97073e6b05302db3d28d

SHA1
7f6760390d27107499505506e315c2fba6e2b729

SHA256
22aa5eeb82a6b1742e151bf9035925762315464c9720b802cda4307a051cc94f

SHA512
3506b8e90616a1e6a6f78e0129d5813d35ff12353384ce7cd6b5f64088bcdafdbe7731cb7995e418230817b1de2997c48f5f2020811cc324753641c38194469a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e624990337886da2db4717ca0d0cfa94

SHA1
7f7c64f05e1df1fd60e135404f1ae585a8a894b8

SHA256
6edf7f183d1c7c6d1101d290f2334e5876c2221d391164d1b179a3200380036b

SHA512
604f447ed1531ff27a59d41a4b7a03d4a7b55eac800e832ea6c76aa7678b4c9ba1de77dfeaa9b983f9eeaf26f59366caba0a00bb52050f015a68334bf5056edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51a50e2a99571d2c8d1813017289e9a6

SHA1
2758bb60a9c3cb01e72cce92ce9cd7fee05ab3a7

SHA256
05d6f8badc12c09dc9d05b29031e8506d7027066adc6eeeaae68e541fdbf0ee3

SHA512
38ffa8b66c80f85d9e4e51a6d92a19245050325b37201c37a4c8d09523ce0fe5bd3cce5de292f1d6d370b858eb3bc9a3029ac2facb221447df98b0f01b2a2c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33ad327e668e9bc9e167f831850f38e9

SHA1
5b8f1d51c0082af399c73cad76dbdc9cf3045328

SHA256
3a8b6f34659b989e43d3e49f013a6a3622e2023aa9cd586fa15f2e66d7b30265

SHA512
db885c42e462f76b70e65af03f73df70e75e88aa2fb632d5e4fa24eb1d84c5155229f8517755f87498eebeb6f4ce3bb904349cee8e8af9da101ca04c684ac723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
f5590bdc04c63f42481e887c013d83b0

SHA1
3b62880c62c6002238fa07231a9b505f4d03bc9f

SHA256
a2aa4e72d1851e478b16225119dd1ac2406495d0995c695f2f22ffcf5298f13d

SHA512
e4dbf5b7c23d59de1f04191e5228ebec06a764a4843f02c16ece33698d6e7b61970524b90f7bf81eb97ded74511b9d83ebd19bcadc6fc52ca71621bb2eb0af81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
1a7ae6d80cfa499ce4f8bccdd745c5df

SHA1
4d02561412aa081cf71a5e285bd5a76465fe30ed

SHA256
b381f3401cb9c8fe76674eb24cb79655db66c12c647dba0918a5772516ba8286

SHA512
f02792e072f5872712e9cf5ce22205e418e1efc8d2bb13a58490e2c62ee133ad09521ee5a03220e80c51d9e8a45fc99161b9ef4fa9dd07b8e1fddb1d5bd81277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
d4ee56d774f58d0192cf268ef5cad179

SHA1
12ad4a5d10a7d1d6e9234202b5592dfc6928b91d

SHA256
6b9f449b8a171b367aaf0458489f5c5a3a0571ac8cb946dfbb5c94502bdb8f76

SHA512
d2c0fb02bd2fd2ab052299ff64a181863c8b5c6d7e3f7e9fbb11b59ba008e38112f69f8eac5c092313bf1fa682fd3d265b40a76d88e13e68a9e74b36c62ff6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f2bc.TMP

Filesize
874B

MD5
2118ee6cf43dcefc055a5036dfc30a3f

SHA1
72ba3a198795d4dbf316465f559e79c4a7ec7efd

SHA256
c214490665baf3cc0c76679a1955b3502084937d1cc8a7ebc719c0d9541dcb0d

SHA512
21f1c0575717378b70a9e969b83b088abfadc3994ef1619c896698de1074d15c6101fb3f3daae1c77e21c161cad5c1f60e3bf9a70b9db3eac1552cee7152076d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7e415c0461a58bdce2b236d499a5f231

SHA1
fbcca5e008a6afcd7ba6e42ab218ad72ab3f8d67

SHA256
d2caad721bf9c95b9b02d8324ff73e2bd138b4e18fcd60c5eb4781439ad4d306

SHA512
98cb08afc76a796242e75de4afa8567b819fb104b1826f1f1f4daf78de6802ab2261dbc95ef227ba27d38be6641cdda9a35069e385ba646a79f2bff2709971fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6d18dfb0aa5fcc8f027a35e42a9f0066

SHA1
fc5da83e7eac77b045844cf74b175104cc8d43e1

SHA256
16bd449e81c4ed504c3a01cbaba16eee82b8acac4a763babfa6d860b0599eacf

SHA512
c2ef65d6b18378a0fd59df457f7cd78b44b1457f60eaab6aaafdf9d47e423fc8a95d6b58a3e6abf91a8440e506c637b1dc3ea32a8300044d4223c53e10b86382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6fb5b7b705e5dff45e1f161e7732871a

SHA1
c4bb3ea6f6768cac1b9579476f1060a8ee080a97

SHA256
2fe072458a042313db29e4614fdbeca1df5da020d8b6bba8398cf5e888d655ba

SHA512
6b62e9e069366c589d7a9e61e77d0d906c8c32097231dd8f046b63f6e2b6007be7c4d9ef73700e928152fb9eeaad54bb8386c949e52183dfa7838355e5b7f191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9b21c1a1ff42219dc32f60398443f908

SHA1
d15bc46689ff92a8101abb36655b92b0a61f892b

SHA256
b5fa38191ad8a1db018b1626c9137ed09245f436552a26c15cfbd90a46409c14

SHA512
2c4dd80f763bc7dfa58f96aba9dd60cd831c890da257eb8451b9153d7142dad044a889f894f77b187b5c29891b7604003e1c6a28e37bee0fef0097d2c702d5e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
55f8b816c315b3eee75e1a03986b5cb1

SHA1
ba6e2ac452a8ac228ec6b634d73aaa60ea9e8bf5

SHA256
d8ce1ff2d48a7af0a1482da26caa98a73ea0ccb09c796d2f1589c2a192443c48

SHA512
e3a6460613774773a7be7596b06a828ed67ad9ce46445b85a27b6c48e0238463a87a9e90baeb50b4313a5aa32a3813fa89cb0e674faa755a944690519ff28399

Download Submit
C:\Users\Admin\Downloads\Electron-Electron.zip

Filesize
350B

MD5
c1c8c99188c951e2263b6f6c109859cb

SHA1
e6c2cca4589bdb4df530a3070b744eeecf7abd02

SHA256
22173a9103bbed7c135b66e48cb94374334e2c0933c64e98291b2f6a474f47d8

SHA512
eda949d07fa2d4e67e05f607bab5140ca1fde96b8ad811a852820b4416e331a6133acfb60658255712e85221930968020735c2c80cac243fea38e24021aafefd

Download Submit
C:\Users\Admin\Downloads\Electron.rar

Filesize
1005KB

MD5
c1b9a01c71a20722f2a5eae520a57870

SHA1
cac6be90ef69d4b60ffe1b12ef159cee83227da0

SHA256
942fa15a06ebfe1f7005cb5e5e7d5c7fa46830eb8009815c09279f330f907c34

SHA512
8b497013804f4cbd79ca5e95a8f0d60f6fc4114a3ff54cf796d379ac090751cf113826076dd1d01f2b6e55924c023f6d41403ebdbe7ff9d64a190b3bcbac4191

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 245382.crdownload

Filesize
7.2MB

MD5
bfd191a3113a5771c09ee16379311bb0

SHA1
0155f01c7fec7eb242057426859d32cf47336b42

SHA256
0589e2b862392465ef056a9c21a84566ef39bc33c9bed2831c5bbeaf6fd659a6

SHA512
e7f34854a9e87ce92f2c5a47165bfe1122ebfb2747497759c14fc9fed8b8d3eb0ab1b19a7629355422f2d61ed7087e6aeed446cd74d707c42bae6270264da3a7

Download Submit
memory/2108-339-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-344-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-346-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-345-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-347-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-348-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-349-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-350-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-340-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download
memory/2108-338-0x0000023840E90000-0x0000023840E91000-memory.dmp

Filesize
4KB

Download