eacd5ed86a8ddd368a1089c7b97b791258e3eeb89c76c6da829b58d469f654b2

Analysis

max time kernel
299s
max time network
251s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MrsMajor 3.0.7z
Size

234KB
MD5

fedb45ddbd72fc70a81c789763038d81
SHA1

f1ed20c626d0a7ca2808ed768e7d7b319bc4c84a
SHA256

eacd5ed86a8ddd368a1089c7b97b791258e3eeb89c76c6da829b58d469f654b2
SHA512

813c0367f3aeceea9be02ffad4bfa8092ea44b428e68db8f3f33e45e4e5e53599d985fa79a708679b6957cbd04d9b9d67b288137fa71ac5a59e917b8792c8298
SSDEEP

6144:HMMAgnxjSgdHCueEVIzAMAcqXvYEC86TFSQ:HagxjSg1xrIzAMAcuI5TFT

Score

10^/10

agilenet evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 5 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wscript.exewscript.exewscript.exewscript.exewscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exewscript.exeMrsMajor 3.0.exewscript.exeMrsMajor 3.0.exeMrsMajor 3.0.exeMrsMajor 3.0.exeMrsMajor 3.0.exewscript.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	MrsMajor 3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	MrsMajor 3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	MrsMajor 3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	MrsMajor 3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	MrsMajor 3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 10 IoCs

Processes:

MrsMajor 3.0.exeeulascr.exeMrsMajor 3.0.exeeulascr.exeMrsMajor 3.0.exeeulascr.exeMrsMajor 3.0.exeeulascr.exeMrsMajor 3.0.exeeulascr.exe

pid	process
5576	MrsMajor 3.0.exe
5508	eulascr.exe
5876	MrsMajor 3.0.exe
1236	eulascr.exe
4628	MrsMajor 3.0.exe
5900	eulascr.exe
3160	MrsMajor 3.0.exe
2304	eulascr.exe
5960	MrsMajor 3.0.exe
5096	eulascr.exe

Loads dropped DLL 5 IoCs

Processes:

eulascr.exeeulascr.exeeulascr.exeeulascr.exeeulascr.exe

pid process

5508 eulascr.exe
1236 eulascr.exe
5900 eulascr.exe
2304 eulascr.exe
5096 eulascr.exe

pid	process
5508	eulascr.exe
1236	eulascr.exe
5900	eulascr.exe
2304	eulascr.exe
5096	eulascr.exe

Obfuscated with Agile.Net obfuscator 4 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp\eulascr.exe	agile_net
behavioral1/memory/5508-164-0x0000000000600000-0x000000000062A000-memory.dmp	agile_net
C:\Users\Admin\AppData\Local\Temp\ED8E.tmp\AgileDotNet.VMRuntime.dll	agile_net
C:\Users\Admin\AppData\Local\Temp\1E14.tmp\eulascr.exe	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

Processes:

7zFM.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe7zFM.exeeulascr.exeeulascr.exeeulascr.exeeulascr.exeeulascr.exe

pid	process
4144	msedge.exe
4144	msedge.exe
4960	msedge.exe
4960	msedge.exe
1816	identity_helper.exe
1816	identity_helper.exe
436	7zFM.exe
436	7zFM.exe
5508	eulascr.exe
1236	eulascr.exe
5900	eulascr.exe
2304	eulascr.exe
5096	eulascr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

436 7zFM.exe
Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
660

pid
4
4
4
4
4
660

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

7zFM.exeeulascr.exeeulascr.exeeulascr.exeeulascr.exeeulascr.exe

description	pid	process
Token: SeRestorePrivilege	436	7zFM.exe
Token: 35	436	7zFM.exe
Token: SeSecurityPrivilege	436	7zFM.exe
Token: SeSecurityPrivilege	436	7zFM.exe
Token: SeDebugPrivilege	5508	eulascr.exe
Token: SeSecurityPrivilege	436	7zFM.exe
Token: SeDebugPrivilege	1236	eulascr.exe
Token: SeDebugPrivilege	5900	eulascr.exe
Token: SeDebugPrivilege	2304	eulascr.exe
Token: SeDebugPrivilege	5096	eulascr.exe

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

7zFM.exemsedge.exeeulascr.exe

pid	process
436	7zFM.exe
436	7zFM.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
436	7zFM.exe
436	7zFM.exe
5096	eulascr.exe
5096	eulascr.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MrsMajor 3.0.exeMrsMajor 3.0.exeMrsMajor 3.0.exeMrsMajor 3.0.exe

pid process

5876 MrsMajor 3.0.exe
4628 MrsMajor 3.0.exe
3160 MrsMajor 3.0.exe
5960 MrsMajor 3.0.exe

pid	process
5876	MrsMajor 3.0.exe
4628	MrsMajor 3.0.exe
3160	MrsMajor 3.0.exe
5960	MrsMajor 3.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exemsedge.exe

description	pid	process	target process
PID 1768 wrote to memory of 436	1768	cmd.exe	7zFM.exe
PID 1768 wrote to memory of 436	1768	cmd.exe	7zFM.exe
PID 4960 wrote to memory of 2532	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 2532	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3820	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 4144	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 4144	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe
PID 4960 wrote to memory of 3248	4960	msedge.exe	msedge.exe

System policy modification 1 TTPs 10 IoCs

evasion

Modify Registry

T1112

Processes:

wscript.exewscript.exewscript.exewscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\MrsMajor 3.0.7z"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1768

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MrsMajor 3.0.7z"
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:436

C:\Users\Admin\AppData\Local\Temp\7zO4B135789\MrsMajor 3.0.exe
"C:\Users\Admin\AppData\Local\Temp\7zO4B135789\MrsMajor 3.0.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:5576

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\EFB5.tmp\EFB6.tmp\EFC7.vbs //Nologo
4⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:5608

C:\Users\Admin\AppData\Local\Temp\EFB5.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp\eulascr.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffca4cc46f8,0x7ffca4cc4708,0x7ffca4cc4718
2⤵
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
2⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
2⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
2⤵
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
2⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
2⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
2⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
2⤵
PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
2⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11135876539675446737,14423387383291479096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
2⤵
PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Users\Admin\Desktop\MrsMajor 3.0.exe
"C:\Users\Admin\Desktop\MrsMajor 3.0.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C5A3.tmp\C5A4.tmp\C5A5.vbs //Nologo
2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:3140

C:\Users\Admin\AppData\Local\Temp\C5A3.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\C5A3.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Users\Admin\Desktop\MrsMajor 3.0.exe
"C:\Users\Admin\Desktop\MrsMajor 3.0.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4628

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\ED8E.tmp\ED8F.tmp\ED90.vbs //Nologo
2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:5324

C:\Users\Admin\AppData\Local\Temp\ED8E.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\ED8E.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Users\Admin\Desktop\MrsMajor 3.0.exe
"C:\Users\Admin\Desktop\MrsMajor 3.0.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3160

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\1E14.tmp\1E15.tmp\1E16.vbs //Nologo
2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:5088

C:\Users\Admin\AppData\Local\Temp\1E14.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\1E14.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Users\Admin\Desktop\MrsMajor 3.0.exe
"C:\Users\Admin\Desktop\MrsMajor 3.0.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5960

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C197.tmp\C198.tmp\C199.vbs //Nologo
2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:2116

C:\Users\Admin\AppData\Local\Temp\C197.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\C197.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\eulascr.exe.log

Filesize
1KB

MD5
8b325485d0cc4762f87c0857e27c0e35

SHA1
1514778327d7c7b705dbf14f22ff9d8bdfdca581

SHA256
c18709d3ab63bebbbeba0791cd188db4121be8007c896a655d7f68535026cadf

SHA512
9bf9da14e50301d68246dc9f3a21319a8fbfc866d5b57ee44cd9ed96c1a6dfecabcec06b66be5ec5625ff708d460e23d00849c581957ab84c4f2941cee07ff33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edff557cd1410dcd4f85acc18d91efce

SHA1
a849de25076e77e9a674ae8906847feb69d12b3a

SHA256
ea30a117709afabe044efacb9d3a5323c5cfcda310145e0f2064dbb96752be07

SHA512
c6e32864322d61e5b116ab983c8ba293e41ef659f3d663d1498f93288a18710e2a395307b45fb61b60d8f748bf9780021a7ab9290f0d00d2bb843bb5269e025f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f07d9448a66dfa5b06eaaba59472b6f2

SHA1
5521f37ae3e9112834aec94caa9662e5914adb4a

SHA256
baef4e0f1567bf9d2e9f0ccd6044ef0bf484b16dc1d1f57d17111737e5de4b2a

SHA512
fd6e52b2d830fa1379f9badeb42e6dfdf3392fe7246b29f08649ddd1f93d1a5dbedf45f34ea5f88d1dc2b66671b4ce3b25d371d1e89525b700d9ca3cdbef3797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b05c79813ebcb979808fe17a6f131fd5

SHA1
b2cfbc978fcd77fe3a15b6da15f88f4837e98634

SHA256
72da07c007ed40d0ab2e8614ef8c4e0bbab7578298466526772315648c204577

SHA512
02dedbbc68305e06ac43d257988a5a4e116b83ebd1c100caacdf179c5ca0c490068c7d76efd928954d6c4092b5b1d33cc1b4acd03aa1ef808469290d576e2c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4633a334960634b87e000fa583fddd5c

SHA1
846e7053c145668826acb9d0a9f91728f8429e1c

SHA256
f1ea9b13229a8a22259aecff997529a9a6cd5a707ef2c13712dd94057df5a8f6

SHA512
a4d3f56ea2257a868c2dca86bb63e714e792068334038935ce7ae1296c69b4952ea2e655e0db77fa902eb80f571c17f26f96793a4f5f7bdb190c265023e39487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
419ab924f9289b0f6018bd3e3249efa4

SHA1
ac50224905c4c25dcfacd80a2a193616d4785a22

SHA256
955f4aeed2b29726e176180b9fa3cb01a16b27245711c9adf5699e5b16d4fec3

SHA512
79db6e3efe69b78eb4cf93629bf7fff504843eceaa39062ec9e9caca0c1fd4385222332b571102a3f4c999a9628908d379daf1931d01eac46bd84da63109e127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\1E14.tmp\eulascr.exe

Filesize
64KB

MD5
e0376b1bfdc9b5dd00809d6bcdb2f5cc

SHA1
16ad513726588e0259ed81572fdb97e0e200efad

SHA256
8974dcab253fbdb90f3ec755ac2ddeb30ee5d4161c00e0045c80ddb708c99a49

SHA512
f4d3299f058d5f30629e09b29b69b400fb0e8b98dd477362907da31eb0683c37e35a2b9159a93d254d4fc2862b7f8c44a8025d1fce0588d6d6d2db2d0a3e6c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll

Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4B135789\MrsMajor 3.0.exe

Filesize
381KB

MD5
35a27d088cd5be278629fae37d464182

SHA1
d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

SHA256
4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

SHA512
eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ED8E.tmp\AgileDotNet.VMRuntime.dll

Filesize
49KB

MD5
266373fadd81120baeae3504e1654a5a

SHA1
1a66e205c7b0ba5cd235f35c0f2ea5f52fdea249

SHA256
0798779dc944ba73c5a9ce4b8781d79f5dd7b5f49e4e8ef75020de665bad8ccb

SHA512
12da48e8770dc511685fb5d843f73ef6b7e6747af021f4ba87494bba0ec341a6d7d3704f2501e2ad26822675e83fd2877467342aacdb2fd718e526dafd10506b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp\EFB6.tmp\EFC7.vbs

Filesize
352B

MD5
3b8696ecbb737aad2a763c4eaf62c247

SHA1
4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5

SHA256
ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569

SHA512
713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp\eulascr.exe

Filesize
143KB

MD5
8b1c352450e480d9320fce5e6f2c8713

SHA1
d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a

SHA256
2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e

SHA512
2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc

Download Submit
\??\pipe\LOCAL\crashpad_4960_KFYHAMSSAFURURSR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1236-198-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/1236-197-0x000000001B480000-0x000000001B490000-memory.dmp

Filesize
64KB

Download
memory/1236-194-0x00007FFC95D50000-0x00007FFC95E9E000-memory.dmp

Filesize
1.3MB

Download
memory/1236-196-0x000000001B480000-0x000000001B490000-memory.dmp

Filesize
64KB

Download
memory/1236-195-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2304-223-0x00007FFC95BE0000-0x00007FFC95D2E000-memory.dmp

Filesize
1.3MB

Download
memory/2304-224-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2304-230-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2304-229-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/2304-228-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/2304-227-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2304-226-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/2304-225-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/5096-244-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/5096-243-0x000000001B360000-0x000000001B370000-memory.dmp

Filesize
64KB

Download
memory/5096-242-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/5096-241-0x00007FFC95B70000-0x00007FFC95CBE000-memory.dmp

Filesize
1.3MB

Download
memory/5508-172-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/5508-164-0x0000000000600000-0x000000000062A000-memory.dmp

Filesize
168KB

Download
memory/5508-168-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/5508-178-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/5508-173-0x00007FFC960B0000-0x00007FFC961FE000-memory.dmp

Filesize
1.3MB

Download
memory/5508-174-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/5508-175-0x000000001D570000-0x000000001D732000-memory.dmp

Filesize
1.8MB

Download
memory/5508-176-0x000000001DC70000-0x000000001E198000-memory.dmp

Filesize
5.2MB

Download
memory/5900-212-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download
memory/5900-211-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/5900-210-0x00007FFC95BE0000-0x00007FFC95D2E000-memory.dmp

Filesize
1.3MB

Download
memory/5900-209-0x00007FFC94500000-0x00007FFC94FC1000-memory.dmp

Filesize
10.8MB

Download