hxxps://steamcommujity[.]com/104923960430529

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommujity.com/104923960430529

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

3676 vlc.exe

pid	process
3676	vlc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1268	msedge.exe
1268	msedge.exe
4672	msedge.exe
4672	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

3676 vlc.exe
Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
644

pid	process
3676	vlc.exe

pid
4
4
4
4
4
644

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 4204 firefox.exe
Token: SeDebugPrivilege 4204 firefox.exe

description	pid	process
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe

Suspicious use of FindShellTrayWindow 39 IoCs

Processes:

msedge.exevlc.exefirefox.exe

pid	process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
4672	msedge.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe

Suspicious use of SendNotifyMessage 35 IoCs

Processes:

msedge.exevlc.exefirefox.exe

pid	process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
3676	vlc.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vlc.exefirefox.exe

pid process

3676 vlc.exe
4204 firefox.exe

pid	process
3676	vlc.exe
4204	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4672 wrote to memory of 4380	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 4380	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1436	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1268	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1268	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe
PID 4672 wrote to memory of 1768	4672	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommujity.com/104923960430529
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fff7dd746f8,0x7fff7dd74708,0x7fff7dd74718
2⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
2⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
2⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1920 /prefetch:8
2⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
2⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
2⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
2⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
2⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6372 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8089413206869869025,15999488947092896028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
2⤵
PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2764

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\HideCheckpoint.ADTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3676

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\SetAdd.vbs"
1⤵
PID:2116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4204

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.0.1503035982\210136666" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3183e3e-9ee8-4bf6-9267-4637711f9d0d} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 1948 22bbf1d3e58 gpu
3⤵
PID:1496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.1.1031138231\1207165615" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6505448d-fedb-469d-9100-ccec7640329b} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 2348 22bb2972b58 socket
3⤵
PID:4388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.2.19594746\1703898453" -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 3000 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caa5276f-1f9b-42af-997e-505d1c32a58f} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 3308 22bc3397858 tab
3⤵
PID:3144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.3.583028368\1770245369" -childID 2 -isForBrowser -prefsHandle 2980 -prefMapHandle 3004 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90123b2f-4149-4fce-8546-f49f49293267} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 2992 22bb2962258 tab
3⤵
PID:4192

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.4.1998696669\12314520" -childID 3 -isForBrowser -prefsHandle 4400 -prefMapHandle 3984 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {861a1cc7-0444-49a5-986f-eacd9af4ee52} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 4408 22bc4fb1e58 tab
3⤵
PID:4896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.5.1804948141\1179268832" -childID 4 -isForBrowser -prefsHandle 5208 -prefMapHandle 5200 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {454d0ca2-6cf6-4540-a72e-ae3750eae426} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 5216 22bc54dae58 tab
3⤵
PID:2184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.6.1204126133\1132050574" -childID 5 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e493d47-d30d-4a7b-9a49-ecf8a0f00695} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 5360 22bc56a8458 tab
3⤵
PID:4552

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4204.7.777434528\1867920670" -childID 6 -isForBrowser -prefsHandle 5556 -prefMapHandle 5560 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {befe744d-c1a5-422e-a95f-e34c11d69d36} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" 5548 22bc56a9358 tab
3⤵
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54ae3454-2eca-488c-b63f-a483ff39c601.tmp
Filesize
12KB

MD5
e8e9d9ddd745724b2b3501f7809f5d03

SHA1
7344c715d192cc9751c6d89f386c2bbcbcc4fad8

SHA256
bf9902abb1576ad16d87d71863849d4d0ae35d75dea8aed3d9ebbeab0ea1b3b9

SHA512
13cffaafcbc64deba2de04a3536b71334818cbd14eceb61da7543a00a0f43493cc80f5c5dcb54f4e73ab730b1cc958a5f068dd78433428ff6ca8024741150bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
cce5aae367e4217bf51ffe4ba4b5a4bf

SHA1
2eddddd54475eedecf6ed5a1ada0db1cc478c966

SHA256
87a97a8f1ac64211d9e07724555ef36d4c60acedb7c6e56fef40913ae6545fd2

SHA512
fac169ee99fe456e435dad04bcbd6778231ec6c0c444140b41c1f8a915ea1ae17add81215a473b0613608c8efa24d3a74f8b53d35174ef0a26190529bce78bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
938B

MD5
b422367b55fe9ff54d5e5ad754836702

SHA1
f186cdaa19715aa8c5e8cc552d306c5692777805

SHA256
8415a2355274f25a48769bde654e42500ae56c846850f0b1afb1bea193b6e3a6

SHA512
bab75cf948685013f04be64dd1a1ecb5bf123ab45f9c4ed83e36cc8eb9b1e60bcbd42525049f6beea98b78382d5ebce057b3ee6a2f5aa04e1756377a54aa8677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
788B

MD5
b2236cc353f2eeec98a736a25f0a57f0

SHA1
6ff4bb20c97bac3a55c3aaaf347217e6e1036a61

SHA256
6bc199af5a4edb9bfa78374689a2db935a6f30f0d8eba01e8faca6cf6fdb0d50

SHA512
7467e8df0e32f1a407a6b05682edf93461141eb75c35f9e012aa5e264345abef1eaa0ef455337017831aefda832282af63bc29a3aeb8bdd568759430b3aca1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d07506a95e1ebb16027aeeb9f1f0abbc

SHA1
c1191fa20f70856dfa651f44232085007243c257

SHA256
5d3d6f1bf7aeac05acfc05778a72fabc19accf666e63ebea26b3a3732b04c23b

SHA512
a6940dfa347e21246a1083a66a3303388494624857d85164d52c5ce69f068cf09183c82c919b3a4423f2bfb903b56b4881703db6472f43b73988d821ee6e4f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
414c871108d362f19c71dc7bc5430a85

SHA1
1fa4e8377fdd21e7eda66980c935343c6edd177c

SHA256
63e3112736423d880f2adcd8422c7040e3fa6d7e41daeb56f5dd66a819d2072f

SHA512
8b75964d49d82ab72a38e36e33407d6e6198cbffbaf075367d664c4f88e66818a084fb5e6de555712164edaf68902120b693b7e4db64bad908522a74e9fa8c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
755e2909de659e85f596362d4223e1ea

SHA1
9ba5b73190b706698f8457a1deb5fdc4535affb4

SHA256
b61e6b2a84fc7af3a1a5aed40e84e889d396b331f3c8161a08df375e24243559

SHA512
7dd622b8ac832ab3ed26717aebd42221a5b9eefd3224f992e99392fe057f2529a9837b428bf0bd2bbcf797a4e8c60291e090830337b4551d7a588a65af020cf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
50ebf5e58b969d747fc0662c2b95a5ce

SHA1
8ae79475eb8903077bc2ebb30dbc894c5d47f7df

SHA256
5d21ceb72382df5ae001dc7c623c6345551971e258e06936f714f4390732ec7f

SHA512
c3c37f6aa5bf7e2d1e96003ea47283db4c9ee5fa54f540a39f65b9285d4b32841f2e1fd035b3f7228e2208d69cd7d83984799d10081938801cfdd6b2950bf63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
074a0f85408819c066e4bf3cd420c3f1

SHA1
571a8180e42f63cfe03f4d051cdab237bac64b4d

SHA256
5435ae63bc5053e1a4758c3646a70a691d542c2d269d84976b70eda9674714c0

SHA512
4d63eded3bfc5cf89dee7c1d03d649f61f0f79a30432163c20de1edf1536b81abd5bc449bd03dd67411551310d692edda8809a961e239c67bb777d75e0f83dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
e36a787051231ccf87bb308bf2e1620a

SHA1
40601e9c46146ad8ffae1995af39f34dd28b8e8d

SHA256
0de2deaa0072c7009662e0769edc0af72ee3256759005399a272c71b9c347833

SHA512
7d39c60ae1bafcf661d46ac373fe69f073d90bce27a7c5070e5bcc584682acea376c32be09d3ba220ebe6471a218f2af3e2795a4c490bd0e4aec12f252560e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8d5b329f0644f51420bb784669925cb5

SHA1
96d0b9950bab8e4df5fbe5b285bf00822bc6f8b7

SHA256
0098d1290612b1cdf468a9427f018c2778c9a37f7417622ff8c8a6e8193d71a2

SHA512
1045cc508b248a3f9d1a195114fa87e7338026c1284f35d4590977d0bcc5e1fc353449c75ac01958626be881f6d6964b68db59ce70885a2f1cc181f5fc006f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
d4b623e9436b754bea9644ac8b875ad1

SHA1
0d6440da88303543d0dd51c5e922b9413a28d89e

SHA256
8ce3ad7f5e4104e2f153abfd4f0fd5665b93ede85f54173e25ca10227325c2ee

SHA512
4a8d573b350486263238334a7fd51a2fd7698886db383b7a440a2985fbb04067480cb8b014731ee0005c503c61cfc0a2221327dd706422c25878cc49006ea794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5851c5.TMP
Filesize
540B

MD5
4c8a70144a9b11b96f8597ed6e1c44f3

SHA1
ee2330a593f0871ffb7e1aefc580a48102e1bbc2

SHA256
1133b87b82cca789938fa5b43a2da86247b3abae353de8093c5760b2674ae0ac

SHA512
f096752a2153dee492df3e4b55a579cc6976efb411bed42c9ab36d519eec6a56c3b7bdfdb7914b983eb4142d2a6f9cf0cc399268192c96f780b09cb85a5e28be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9b125b7530206bcf668f61a4fcb34023

SHA1
f5404aba10b4bb498eb09f423fec90155aaff48c

SHA256
f867a01a8b33c1cfd9b7630b1e8047f351c810c89b2f78adc42d8637504e49fd

SHA512
399e65107ff57020495b3d2acb5fa989d92892991bbee2e6fe413e0c1ececacbe33025a506edfe9a19a3c55acbdf4e9da253000bb38f696115c25e0f68fd1d29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
610fc15a9f28a4af06444a6912710dfa

SHA1
32b8641180ec36479ebb21a575448166b58c93f5

SHA256
9d5cb35848e24bc955f0704b8349e35e04344d9b4540f9c8a38b615ca54c0803

SHA512
0907c8a3bc307384b64d5cd3a20523e959139c37f1c150406c6b16b3550f8c32b47c79801c0a2c2b1dd661a8c24893cf22311f3155b3494bcf55bf17b104024f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
66bf10c9c477a28eda5f5eac3ff25290

SHA1
07aed10f11c4dabe7ede1b817bc870a6c14d6635

SHA256
114ea95a189e72ccf37cf6463808c5b1be57fc397aabd1648e5c0ed13c90cce9

SHA512
ed24f7a221eaa38783cf3a2886c53c40e48c0ede56a78efc94496573763d66b5765a7866c1b6763024bd1dfe1c6378d38410b1b80a4523caec4cbde2142200a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\pending_pings\15485d5b-8df6-4c36-a6c9-7f667700009b
Filesize
9KB

MD5
7c1902c96b768884d70b30fec1972a87

SHA1
184db7fcefc609dd3898a5f50daa1b59d3ff81f6

SHA256
d8ff3428f890ac3b845873e219a438b1bc559955091eb590fbda588955e6ec2b

SHA512
c4a5613c479961cd97e58dfd836701979da3c157547a19f4ec6a75d711463370590bf43eea700276bfc83b57c331da05bfbf0766d674d5f0926d8a0cfb150780

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\pending_pings\bb40132d-832d-4f13-9a7c-9e539366a44f
Filesize
746B

MD5
833c5c5a58d838c3d5be6b1d9fe39a04

SHA1
14fd6095173bd9abaa982bf6ffdb2dd227695642

SHA256
44764a42d6349683c79ff79c67963b6bce45ed47c01e555a21d7ef021b377477

SHA512
b2f93da02e6f5d265d2ad3c37d0329e53fae8a41ffad0014e4c7375e017a0c18dfc2b86746d9b229cdd17d25b4e04a4322ac9c0fa760a567df62bb8859a052f9

Download Submit
\??\pipe\LOCAL\crashpad_4672_GIFYROVNSSOPRAPV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3676-316-0x00007FFF69D70000-0x00007FFF69D98000-memory.dmp

Filesize
160KB

Download
memory/3676-327-0x00007FFF69910000-0x00007FFF69AC2000-memory.dmp

Filesize
1.7MB

Download
memory/3676-292-0x00007FFF7D830000-0x00007FFF7D847000-memory.dmp

Filesize
92KB

Download
memory/3676-291-0x00007FFF7DA70000-0x00007FFF7DA81000-memory.dmp

Filesize
68KB

Download
memory/3676-290-0x00007FFF7DC20000-0x00007FFF7DC37000-memory.dmp

Filesize
92KB

Download
memory/3676-289-0x00007FFF813E0000-0x00007FFF813F8000-memory.dmp

Filesize
96KB

Download
memory/3676-298-0x00007FFF6A000000-0x00007FFF6B0AB000-memory.dmp

Filesize
16.7MB

Download
memory/3676-299-0x00007FFF69FD0000-0x00007FFF69FF1000-memory.dmp

Filesize
132KB

Download
memory/3676-300-0x00007FFF7CB10000-0x00007FFF7CB28000-memory.dmp

Filesize
96KB

Download
memory/3676-301-0x00007FFF6D200000-0x00007FFF6D211000-memory.dmp

Filesize
68KB

Download
memory/3676-302-0x00007FFF69FB0000-0x00007FFF69FC1000-memory.dmp

Filesize
68KB

Download
memory/3676-303-0x00007FFF69F90000-0x00007FFF69FA1000-memory.dmp

Filesize
68KB

Download
memory/3676-304-0x00007FFF69F70000-0x00007FFF69F8B000-memory.dmp

Filesize
108KB

Download
memory/3676-309-0x00007FFF69F50000-0x00007FFF69F61000-memory.dmp

Filesize
68KB

Download
memory/3676-310-0x00007FFF69F30000-0x00007FFF69F48000-memory.dmp

Filesize
96KB

Download
memory/3676-311-0x00007FFF69F00000-0x00007FFF69F30000-memory.dmp

Filesize
192KB

Download
memory/3676-312-0x00007FFF69E90000-0x00007FFF69EF7000-memory.dmp

Filesize
412KB

Download
memory/3676-313-0x00007FFF69E20000-0x00007FFF69E8F000-memory.dmp

Filesize
444KB

Download
memory/3676-314-0x00007FFF69E00000-0x00007FFF69E11000-memory.dmp

Filesize
68KB

Download
memory/3676-315-0x00007FFF69DA0000-0x00007FFF69DF6000-memory.dmp

Filesize
344KB

Download
memory/3676-294-0x00007FFF7D2A0000-0x00007FFF7D2BD000-memory.dmp

Filesize
116KB

Download
memory/3676-317-0x00007FFF69D40000-0x00007FFF69D64000-memory.dmp

Filesize
144KB

Download
memory/3676-318-0x00007FFF69D20000-0x00007FFF69D37000-memory.dmp

Filesize
92KB

Download
memory/3676-319-0x00007FFF69CF0000-0x00007FFF69D13000-memory.dmp

Filesize
140KB

Download
memory/3676-320-0x00007FFF69CD0000-0x00007FFF69CE1000-memory.dmp

Filesize
68KB

Download
memory/3676-323-0x00007FFF69C60000-0x00007FFF69C73000-memory.dmp

Filesize
76KB

Download
memory/3676-322-0x00007FFF69C80000-0x00007FFF69CA1000-memory.dmp

Filesize
132KB

Download
memory/3676-324-0x00007FFF69C40000-0x00007FFF69C52000-memory.dmp

Filesize
72KB

Download
memory/3676-321-0x00007FFF69CB0000-0x00007FFF69CC2000-memory.dmp

Filesize
72KB

Download
memory/3676-325-0x00007FFF69B00000-0x00007FFF69C3B000-memory.dmp

Filesize
1.2MB

Download
memory/3676-326-0x00007FFF69AD0000-0x00007FFF69AFC000-memory.dmp

Filesize
176KB

Download
memory/3676-293-0x00007FFF7D780000-0x00007FFF7D791000-memory.dmp

Filesize
68KB

Download
memory/3676-328-0x00007FFF698B0000-0x00007FFF6990C000-memory.dmp

Filesize
368KB

Download
memory/3676-329-0x00007FFF69890000-0x00007FFF698A1000-memory.dmp

Filesize
68KB

Download
memory/3676-330-0x00007FFF697F0000-0x00007FFF69887000-memory.dmp

Filesize
604KB

Download
memory/3676-331-0x00007FFF697D0000-0x00007FFF697E2000-memory.dmp

Filesize
72KB

Download
memory/3676-332-0x000001F1064B0000-0x000001F1066E1000-memory.dmp

Filesize
2.2MB

Download
memory/3676-333-0x00007FFF69470000-0x00007FFF69582000-memory.dmp

Filesize
1.1MB

Download
memory/3676-334-0x00007FFF69430000-0x00007FFF69465000-memory.dmp

Filesize
212KB

Download
memory/3676-335-0x00007FFF69400000-0x00007FFF69425000-memory.dmp

Filesize
148KB

Download
memory/3676-337-0x00007FFF69370000-0x00007FFF693D1000-memory.dmp

Filesize
388KB

Download
memory/3676-336-0x00007FFF693E0000-0x00007FFF693F1000-memory.dmp

Filesize
68KB

Download
memory/3676-338-0x00007FFF69350000-0x00007FFF69361000-memory.dmp

Filesize
68KB

Download
memory/3676-339-0x00007FFF69330000-0x00007FFF69342000-memory.dmp

Filesize
72KB

Download
memory/3676-340-0x00007FFF69310000-0x00007FFF69323000-memory.dmp

Filesize
76KB

Download
memory/3676-341-0x00007FFF69270000-0x00007FFF6930F000-memory.dmp

Filesize
636KB

Download
memory/3676-342-0x00007FFF69250000-0x00007FFF69261000-memory.dmp

Filesize
68KB

Download
memory/3676-343-0x00007FFF69140000-0x00007FFF69242000-memory.dmp

Filesize
1.0MB

Download
memory/3676-345-0x00007FFF69100000-0x00007FFF69111000-memory.dmp

Filesize
68KB

Download
memory/3676-344-0x00007FFF69120000-0x00007FFF69131000-memory.dmp

Filesize
68KB

Download
memory/3676-346-0x00007FFF690E0000-0x00007FFF690F1000-memory.dmp

Filesize
68KB

Download
memory/3676-347-0x00007FFF690C0000-0x00007FFF690D2000-memory.dmp

Filesize
72KB

Download
memory/3676-348-0x00007FFF690A0000-0x00007FFF690B8000-memory.dmp

Filesize
96KB

Download
memory/3676-349-0x00007FFF69080000-0x00007FFF69096000-memory.dmp

Filesize
88KB

Download
memory/3676-350-0x00007FFF69050000-0x00007FFF69079000-memory.dmp

Filesize
164KB

Download
memory/3676-351-0x00007FFF69030000-0x00007FFF69042000-memory.dmp

Filesize
72KB

Download
memory/3676-352-0x00007FFF69010000-0x00007FFF69021000-memory.dmp

Filesize
68KB

Download
memory/3676-353-0x00007FFF68FF0000-0x00007FFF69001000-memory.dmp

Filesize
68KB

Download
memory/3676-295-0x00007FFF7CFA0000-0x00007FFF7CFB1000-memory.dmp

Filesize
68KB

Download
memory/3676-297-0x00007FFF6F640000-0x00007FFF6F67F000-memory.dmp

Filesize
252KB

Download
memory/3676-296-0x00007FFF6B0B0000-0x00007FFF6B2B0000-memory.dmp

Filesize
2.0MB

Download
memory/3676-288-0x00007FFF6BA10000-0x00007FFF6BCC4000-memory.dmp

Filesize
2.7MB

Download
memory/3676-287-0x00007FFF7D320000-0x00007FFF7D354000-memory.dmp

Filesize
208KB

Download
memory/3676-286-0x00007FF619230000-0x00007FF619328000-memory.dmp

Filesize
992KB

Download