hxxp:// | Triage™

Analysis

max time kernel
900s
max time network
914s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://
Sample240325-cbzyfacg87

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE is not expected to spawn this process	1948	1412	DW20.EXE	141

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dwwin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dwwin.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 3a002e80922b16d365937a46956b92703aca08af260001002600efbe110000009d9b7ff9bc68da0122ed2593c868da014931d7fe577eda0114000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
1412	WINWORD.EXE
1412	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4664	msedge.exe
4664	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
1412	WINWORD.EXE
1412	WINWORD.EXE
1412	WINWORD.EXE
1412	WINWORD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
1412	WINWORD.EXE
1412	WINWORD.EXE
1412	WINWORD.EXE
1412	WINWORD.EXE
1412	WINWORD.EXE
1412	WINWORD.EXE
1412	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE
3628	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4420	4664	msedge.exe	89
PID 4664 wrote to memory of 4420	4664	msedge.exe	89
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 3028	4664	msedge.exe	90
PID 4664 wrote to memory of 4464	4664	msedge.exe	91
PID 4664 wrote to memory of 4464	4664	msedge.exe	91
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92
PID 4664 wrote to memory of 396	4664	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffe778c46f8,0x7ffe778c4708,0x7ffe778c4718
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,1988706064754963183,7403289037937282724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1412
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4792
  2⤵
  - Process spawned suspicious child process
  PID:1948
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 4792
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3544

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
MD5 cbec32729772aa6c576e97df4fef48f5
SHA1 6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA512 425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
MD5 279e783b0129b64a8529800a88fbf1ee
SHA1 204c62ec8cef8467e5729cad52adae293178744f
SHA512 32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 63616fd850785c2185b0ee414d293f0a39617a862a87d67b0a286651bc770d8b
MD5 815e03ca16335c3a48df4145a9206c22
SHA1 a2ec3dcce9fe47f0086f21954ca5c7fd2aab430b
SHA512 4e6dfec7dfa851e97b6646e5fde641b6e59c81e42ea29cf0d4f930ab2408b69d2cd561acf980dd66ed3233a632260e1eef5f568eade838cfac991c1c2b6205c0
SSDEEP 96:n6qkdK21emwpvWMoiVmdeHcmW3mc+UWQyV+VD7ziEwb:n6qkQ2cmGWMXW3mc+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e1ba5a23eacd94878a7ab4ecfb1fb41e934ae9874bbb82cb60676cfd45a000b9
MD5 5262420a5f4968398b781161376e1089
SHA1 fd8050623667153ab9db7bab3d542d7ab43c3f74
SHA512 979fd01e75a2363089829273ea8cb304c4069014780ce7eb5565c7529ab2e0a3ec4160d4bdd39d3cdcae9cf91190496af4c72a80f842ef4625a2484cc07b62de
SSDEEP 96:n6qk4K21emwpvWMoiVmdeHcmW3mc+UWQyV+VD7AiEwb:n6qkx2cmGWMXW3mc+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ee09789e8a3dc89dee778fae05a2f796ae547b4c2fc39c866c6db5dca5c0364f
MD5 337b5061f43c897e8dd3a1ad91a262e5
SHA1 b4e614467f35d1d0f995fcd613bc9e0a8d920448
SHA512 981d9ce42d43ab2777724949c6796fd483490a198c7429a37ad4fb7142e23845a1b0b24c120f51795f75cae4bccc41faee11bcab4a0d064c55f4675f274e576d
SSDEEP 96:n6qkGWlBK21eSwpvWMoiVmdeHchb3mc0xyWQyV+VD7AiEwb:n6qkGWlM2cSGWMXs3mc0xlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 86e127e7d1f55df16e1ca3512ca42f0c25144419e9ec613ea11cd767ecf6cc2e
MD5 5a4ce4a3b2f89870f82c71fb3b85bd71
SHA1 6b74db2c93d78944a4448786e289a3225e3ba99a
SHA512 ba952fbcadb0402a5a366a349d2e298babfb979712feade183f89fa818b74488564139570f47e4592158a574c3cd3420b2f696e677571341ac1b6592c2828308
SSDEEP 384:K9iIxuERzA83h09RZxYTpbKU9IX4aOu8rxfIeEXgdpH7:JIxuERzA83h09RZxubPGF8NfIexvb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d01b41061a7815f5e4dafeca8ca731902c4a39d5f1e225fa5b94c22e2e2852e0
MD5 059adc4d93e685da37f4c0af5608c59d
SHA1 46c573a7b30c7b38eb06eda94489b4f2daf64a16
SHA512 23dd9249982d447c4d1575c43853fdf8e326d8e7263834ad1de679d258e3291771036137853860f16cd7b5477046cbf305d6d5cd07ea9c267fed8b7b89a42b65
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTpWc/Upe2RUMX4TM+b9rSl:A9iIxuERzA83h09RZxYTpb/U9pX4T7ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 8a2e1d151345bae6418270a4c280aea7f3edad66caa1bafd2a58775b815ea4c3
MD5 aa0c59974ef50f54a420f556e976f52f
SHA1 4f86f4ef4c68db25301f13f171bbf995bcac29de
SHA512 c888b363e8a5d03bcef0d745e83d4d8f41e25c8d5bbb3696a21ab6fde2cb3d093c233d8e63a2b5a78d6dcf2d9c58c75e6e7a17dec62c13dce3d6610f19c9e81b
SSDEEP 3:MsEllllkEthXllkl2zEgltz/V:/M/xT02zjd
MD5 SHA1 SHA512 SSDEEP

Submit Download

9E00A6A4-66F3-4643-9F17-0D6D2EF17BF8

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9E00A6A4-66F3-4643-9F17-0D6D2EF17BF8
Size 160KB
SHA256 b494fb1d604897cf16a491ea2c76426b50f1efa137d3e4fe1493ea068efe85a1
MD5 7e16bcd07d8fe4f4b7c3d5c030363cd5
SHA1 1b77ce69b166d6567d1162bf7f1d644a9c088388
SHA512 0e9107b7ccbba495110d621e1a84c3f407920f87c5abdebf36d9218fdfb422dd885aa2892a6cf2d74fbcbbfb452b0ddab1483d91c2a8bbc3719c97edbba42f21
SSDEEP 1536:b+C7FPgOXB3U9guw/JQ9DQA+z1Qik4F77nXmvYd8XRTEwreOR6g:NBQ9DQA+zGXeMJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

winword.exe.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
Size 8KB
SHA256 081d5d7aac0211350a0dabe18a6878bb933f123a088de869d9dad5a073a076c7
MD5 5b9ba8f83672da3a65ed118b28603f80
SHA1 2fe727409d099c09caf3b336b6bd8055be307e1b
SHA512 d21713e8d7a296dbd5b1082964296e93d0d77e62fbf47bbda091a3ca3ec7149cce8fa665bae2f93d2ba8b8bfd60a0f8b83010f1f9fb81bd7e1d2c6912f0e9c8a
SSDEEP 24:KlkDqt8VtbDBtDi4kZERDCJyE4qt8VtbDBtDi4kZERDf:ekDO8VFDYM4yE4O8VFDYML
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 adcd0dc04c252ce44a1ba32ec48a5b9b3989f6be051382302cd3fabfdc5fd94c
MD5 a46ba357a509c28934c14da033e78ba5
SHA1 4e800b2adc857a30fc641ed13880b52b249cfb73
SHA512 dd1813c60b26d966fb5bbccedf23bb33c589a8a248bd5ae9722da21759f7610b2c9d88a216173caac868d8f0f5c9346d14190939a7f0f7b2b8d4474718b7f5e3
MD5 SHA1 SHA512

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 5806c7df59cd03c75c0ceb5db14bf1d0a846a2917665b7707c026c182494c059
MD5 40ca3d1cd15493d0c05b79307b7d08d9
SHA1 9a37191a68b6e82fbce2352633bdeda65338243c
SHA512 d20759f7444108367f588e2958e7e914406dfa71e451201c79eca8ae084becf38ce98e911275b4fef321e397f17133dbdf3c6c0c1aec03eba6282c0785881239
MD5 SHA1 SHA512

Submit Download

9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Size 4KB
SHA256 a7c19703bdad132a63994f6e72c6b3cfa1e7fb343d4f3e65c6145bf816e7dcc9
MD5 fbb2498be32e2d828fe1a3c6efb46938
SHA1 3e2c605b938aacbe64a7da44a4acad90a1a136bf
SHA512 4563f60ed258520a8c57bf52c3e32e8469606b18602fd19c4cab2cd092e8bf5ae81f5cda26748c9fce601d94abaa10720352e4cac6a2e50706a9b37d02041bb6
SSDEEP 96:IdYXSYejyaxbOdZDeD2EUvfCnm+4+wKSvc9D:IdyREnxbOdZDTNvamiwvv8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

~$Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162B
SHA256 cda83a62a31ad8018c1b18ed2eaa5974593ecdf5af57a10490f2a34878205154
MD5 899c1e8d1d562785a4e585117eec8f63
SHA1 dd5a51ef9e326f9df19c2e7f074a6afaefc465d8
SHA512 e185d669132d50dc6256c8ee7fb171f223300a48ede8ff070ba080848dcf4b268a638d5488985640bd6e2731f1e999a6dab0cc80605846f5e8d7ba617c0a08b4
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

~WRD0000.tmp

Path C:\Users\Admin\Documents\~WRD0000.tmp
Size 11KB
SHA256 4b172d581b3050b31bc67c48a057800c14ad6fb8892699e1afab25047a7b7d0e
MD5 71e025980b02d86641b6ebdbe1a3c01d
SHA1 1185b4921acc6793e6291bc32980670d1cfe3129
SHA512 db7f7c85e5de9f263fd66cf41276b25832a3e42afa47aa2e0ed605ae666aa8f57b1d501af314fde08be570de9ac0a5def3a726d187bd0f8255bbb227e85a166d
SSDEEP 192:CtxWZSzASgCCNxtpgoZ22NNA/Ss7ezto9psMDHIGzo7Sx2qYfvr8BP:aIYAvdNxt/ZtNNW1q6js2ZzoOx2qCvrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1412-196-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-205-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-192-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-197-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-198-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-200-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-199-0x00007FFE44440000-0x00007FFE44450000-memory.dmp

Download

memory/1412-201-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-203-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-204-0x00007FFE44440000-0x00007FFE44450000-memory.dmp

Download

memory/1412-202-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-195-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-206-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-207-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-208-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-209-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-251-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-193-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1412-194-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-190-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1412-191-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1412-189-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1412-188-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1412-187-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1948-256-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1948-258-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1948-246-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/1948-254-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1948-255-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1948-257-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/1948-259-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-269-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-282-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-261-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-272-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-270-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-273-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-274-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-275-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-277-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-278-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-280-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-281-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-260-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-268-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-267-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-265-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-266-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-263-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-264-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-262-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-351-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-352-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-354-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-356-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-355-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download

memory/3628-353-0x00007FFE46BF0000-0x00007FFE46C00000-memory.dmp

Download

memory/3628-357-0x00007FFE86B70000-0x00007FFE86D65000-memory.dmp

Download