raccoon | hxxps://file[.]io/0axqjQmDFoMz

Analysis

max time kernel
663s
max time network
666s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://file.io/0axqjQmDFoMz

Score

10^/10

raccoon ba5402edabeb7c302f4642770a58922b discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

ba5402edabeb7c302f4642770a58922b

http://193.233.132.231:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 16 IoCs

resource	yara_rule
behavioral1/memory/4460-878-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/4460-883-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/4460-897-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/1512-898-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/1512-902-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/5012-908-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/5012-913-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/1512-921-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/1512-924-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/5012-927-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/5012-949-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/4460-1119-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/2292-1121-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/2292-1127-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/2292-1132-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2
behavioral1/memory/2292-1133-0x0000000000400000-0x0000000000FEB000-memory.dmp	family_raccoon_v2

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
4460	Mirage.exe
1512	Mirage.exe
5012	Mirage.exe
2292	Mirage.exe

Loads dropped DLL 3 IoCs

pid	Process
4460	Mirage.exe
4460	Mirage.exe
4460	Mirage.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 492629.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
1824	msedge.exe
1824	msedge.exe
4104	identity_helper.exe
4104	identity_helper.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
5060	msedge.exe
5060	msedge.exe
4460	Mirage.exe
4460	Mirage.exe
1512	Mirage.exe
1512	Mirage.exe
5012	Mirage.exe
5012	Mirage.exe
2292	Mirage.exe
2292	Mirage.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4488	1824	msedge.exe	87
PID 1824 wrote to memory of 4488	1824	msedge.exe	87
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 244	1824	msedge.exe	88
PID 1824 wrote to memory of 2988	1824	msedge.exe	89
PID 1824 wrote to memory of 2988	1824	msedge.exe	89
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90
PID 1824 wrote to memory of 2856	1824	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://file.io/0axqjQmDFoMz
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8196946f8,0x7ff819694708,0x7ff819694718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7748 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7976 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8076 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8324 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8704 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8836 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8976 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8868 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9248 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10112 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:6728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9724 /prefetch:1
  2⤵
  PID:6760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8256 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1580 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9624 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:6540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9936 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10028 /prefetch:1
  2⤵
  PID:7156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
  2⤵
  PID:6720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Users\Admin\Downloads\Mirage.exe
  "C:\Users\Admin\Downloads\Mirage.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Users\Admin\Downloads\Mirage.exe
  "C:\Users\Admin\Downloads\Mirage.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Users\Admin\Downloads\Mirage.exe
  "C:\Users\Admin\Downloads\Mirage.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12301857059059442755,9398332460028957701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8576 /prefetch:1
  2⤵
  PID:6340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x49c
1⤵
PID:5832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6964

C:\Users\Admin\Downloads\Mirage.exe
"C:\Users\Admin\Downloads\Mirage.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2292

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x49c
1⤵
PID:5440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\G5ti17ut7y56

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\LocalLow\fq1A7560X5di

Filesize
92KB

MD5
b10be874867a4f41849b9187cb98d1de

SHA1
2a2ceb44953f4978308e04286872050b5e2071e4

SHA256
12726259350583d4b137a4ca783e463b8629a198d6934a43818bdb726e5d858c

SHA512
1450573f2674676c124f0ee1beedcae92bc265d7c100fa587565ee15f13c94f69b9ece621742b0b840681a0b97bde3314508682ff85de75b78e27f39dfa46e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll

Filesize
384KB

MD5
0aa6b569a946cd71f2970a6a83160132

SHA1
2c8557d2b3b287597d4f7b5241ada2d5dbf4db52

SHA256
35baaab0197b94bd5e917eaf6f7c8da36c4c8c9595212cff894698576de00dd4

SHA512
31265bd781cacfdcbc054c3bd9eee4971e91eed2a6c76cef2964431506ec7cf5ca17418e773912e339dc311e0cae7b7e588e4aa89236d089583a73f059c5faaa

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll

Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
1024KB

MD5
4322f0449af173fb3994d2bef7ecb2e4

SHA1
b6ee5c6f76b8eee448f6b4b2b56fa1ec39653934

SHA256
0502e6e2f3fc54a30dea0eb07eb19a395c7ea6fc273321a49a4cc977a59b7cc9

SHA512
d8bae6131a5a8a1fcabb2d7efebc6cdbba27955fb77484a5d87dbce7a237c0cd5e19b74b4dad28312929ad732d3b80cf3d7f15f059c88438d0bc6ff9535ceeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
242KB

MD5
1062cd5142317e4fa358b3927b51fca9

SHA1
5426e16ba5796fcc278801c60c4d0ab5c67ad381

SHA256
bdd9ca6f3470feaa6f6f8c820007c8c178f280e274fdd1fc0f70828bd3ebda1d

SHA512
dbf51e3de71ff8026768845393bf12321600a33052da6bf3d01a91d0e219f6521bcae9c72f51974d98f09a2c85c2d183c263a005265a7e4c323c8b2409e5e878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5e42077b85df235_0

Filesize
37KB

MD5
6ad071f441348e7ab268f0ef1ac0179d

SHA1
f12c359a2f77f1f005b5c815d05249e42eec64df

SHA256
97baf3eacabd42f3da576335dd89ef04d9bf2496cc5896199ef5320410afd61d

SHA512
f98e079a8a655907101114cccdd56f9ffe542a9f891ab01411e4b6883097c8aa5025699695c546845596f3963b44a9d03350fb3180e75a595d1270497e4d7b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
0c4eb8813be659086b9580c3a052baeb

SHA1
10471c542583a405f60806e9abc57232df04cc17

SHA256
38ba82493ac27284c0f917f3b54346fb3a74ac3b2cf2480242ccddacb83a6b78

SHA512
3ecf40b11759b956bd42fa443cca2408a5c3803b98f8e4cf8ff2044fbedd8a173faa361f92669074a88964b5ccd21a47d61a020bee2a1bb5d1484c44cd49a98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5b706cf2ca5fab242677f985f4a46ef3

SHA1
fae34fad4c7c13f5485ed97c23e5812182c932f5

SHA256
c68b6561bad00d2c2d5ca8b248ebfaf5b40d37e4025a0cc2efd281df0b9ab6b1

SHA512
f899a11cf2520c4684a9ff56ccfa3039b1380674b4f7770e66d422694ff3249c8216fe910af54b9a309ac31e5b70f0e316b9697dbf7ab3f764942fc5a6e54f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2f9bdd3dbe80fdc3267e2adba79ab36e

SHA1
514340e1ab2bd47eacf2dc599dc18e115b11745f

SHA256
c1d2398dd513fced36076161d845be891a791221916d900fd54e86a551fe9884

SHA512
0d52c3048235a86544ae6e5af7b2b4a304fb1336bbdf273e3fa27b1b3123c54e8b3bcb2f17323de84805e0d66f6947ca03b823493b52bdd9faf00dc80e4e603b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cc7845552a996bc88f3b5f498a690dfb

SHA1
a0542daf23c4b2b90f4f9592ff25da37b3a24054

SHA256
ac7e30e44c0480903c44f9525623e7d0b3ca42c05995b4e4688bda11ee7b16c8

SHA512
865bdd25dd06c630632aa6d068c453e74a2a4137163423f5e297e8446dd94b9f83e85a51f1f46b749a38f7c70b3ac35672e0f5207a71db30e60a81ac662140f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ee7b7f3ad29efec1833f897854cd1d84

SHA1
eec1f0494d07c0c5f39165a2720074250806ce4f

SHA256
68957c001c0f013651c0449214986f0c503a973666e75690ca50d529a0f8c963

SHA512
f03ee3535fee7bc2036334e1a5c602d0f86484425d4343f00b99bab46fa9dd73873d8c0ae674c0764bba53989abd44ee05f48c8ddc33ace0066449e2c9c0a3ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c1a0c230da8ce23e75b0b13420cfddea

SHA1
1c66376f5a7dcfdf0064fdd4ab479911d05ece6f

SHA256
5c55cd1060182606b8c59326f34f70c671ced87d460f3e365475abe0bccf6d71

SHA512
324da23ef5b1bab3ae022bece40c4ee983babb09c06d5e62a8e00c7f19861c03893ac9c19545f1cdf3834532e59ca5095df0438514b9c657937022e478d3e112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
44KB

MD5
ce436069967f53497be4139dc3759828

SHA1
2bdaeb8954b1fa46ddf538ca410d4dc169a3d8af

SHA256
b1bdcd85320ffc3a0569328a4af810b7dd5c8177977e845e5e380401a9896fdd

SHA512
ec53649d5801a319694cfce6f9a0f5e822615a9caecff2aa8ce10d7cf7fe6208ab53c895d11a65f9424861f938d32f31fb82ecb2a5eb850e9fd3966b4a14726d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_prebid.a-mo.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_prebid.a-mo.net_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
02a9b407c7ff664ecb31ad52e6fcb882

SHA1
71bf4f81ed754497731afaf7dba1d583235a8a5b

SHA256
f75675f94f22eb5138ffad8511b7b0a4c46f266038db1717172ebeba38dd9be9

SHA512
37be82c57b7611fe6dc1d5b598e770074eefc254f0f360917af386485a4d4041e43a7a0b6f325f8fc8ce368105c1c4950000bda378441fff65949a7008e09a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
9b86a7bd096bbc1907ad75ee2681f7b5

SHA1
d7a548d44b12c2a5f1f79608208abaf2ba8f5a49

SHA256
21e9e4042bebbf7217baed6438ad36a6c3ea66dafb75967495a1fff01ea3004e

SHA512
003aee5155d72eaa729c8e28c11f62f7056989ffd95ab43caa4698c3cfa754d67681b6f8fa343bb94f63d33ef707d580377059ea139acb40b210ca9815dcc281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0bd7fce2733db83e4e83f676bd76359

SHA1
97a3ff48c4e7c40fe6bf707a6e33f7fa80544a67

SHA256
325fffc42191a96d1c712722b99117e87a2b5eda76fc2223708a0c6f9aeb0ac7

SHA512
4b90c3596a8838b4cc647ade8e4f73518f25adca339d166053b80afb6065391c2da4a511a899e9fe1ab4fe3c07653578cb7ad4517d776e9221d539c727fab876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
dc83372f19863392385e3c422cd9b47c

SHA1
e9b86578761af48db1060e13dda1b87ed4f0b151

SHA256
6bb265c997aa6fd09a527b87a5a2a512f0021337bc58bb9e9972ff59f9d776c8

SHA512
09859c11e7fd81c781e7680f33f58ab18f78edf4315aa90d6cc26e0f8dbe28bdb167c29638ab7be426427a7a90cebd9c9592ae58803d40c83298260fb3e438d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3a041b32797fe2e99a9ee4e198de8c3b

SHA1
b755973d819c129e28f3a4e2cd47b35ca06dfb62

SHA256
41c4657b639e3c630df2bf70ac416beff29bf77cd791274e47180955048bfbad

SHA512
68403b4e624e3b5521066fa73f363858648ea664226b66b737909264d61da3817c049caf71a1b37eec7ef34a1073c25db16956de863aa7ddf9a8bfe5da9d953b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bec390ecd1133b7e86c026358ff82fdd

SHA1
8d700e9e299e5631da6a365741433b767bb1b745

SHA256
8c0ae17db36fbf8f07eab21f7ce525b7dba09a2ac1f020cd6a15248e2784695a

SHA512
313e9f073f0d055bddfe4eeac783a1d4bdda469353378e553586fb9fa5a55261cc21fa6dc4b24565fcd38b0f9eb5cc13cccb581156e83f9252efd1fc6abb3588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b330e6e4ab2c708cebefa4f7755a2d3b

SHA1
60ec7943a67ac6d12860ce7c952852e430b1d703

SHA256
94e02032ebb682cb25d9ecae15b52894b210faac9b50ccc2643a42c134bed507

SHA512
9ba38002d35262edfdcb244fea3f57527e0c40ffa85100009b6be119b444da8cc4092bf19bb634781272789db336b47c22eb8cfd6681aff8691c5981cdde43db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b59ddbab26b00f1958a615d231cecee0

SHA1
493340c14594894ef06601369b40209b86397cf4

SHA256
f3485e93feb0e5cf4204db317cc7c2ab01c7fe39e41ce890c297b116b99302a0

SHA512
7252a3bae5f90b51bf919fe7ae4958568c981bf94da6f04dd63f2ff1508e7b15e36e19bf04203884ce08620e43eab42994864d67748327f3de3d8a44e59baf69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
52d4858a53ab3fd2a03cabdc20fe56d9

SHA1
64a2bcb96c9803e8674f879bb83d0ee50e011633

SHA256
739f40d7bcb8a0d7d3f4385a202b193bba40d6a906335fd5ef8c519795c7ce28

SHA512
505e2b1158a1596df9092127885c4f724b1da47b7a1900bcfecdaab1b63505c4a9d3370cf5d8b0b11fe885730bd2c680427086260ea451453f2dac770df25c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8db13c67644dab51865d76cd12695df3

SHA1
e6feda22c58db136b0eb1a7f8780c19409af5fa1

SHA256
10dd522cf2fd9e987bc21370993529c8c63a145872eb3300c2051e796c257b96

SHA512
196eb590308ac137fbc98b2f5eb3f09c97311b1e8cd998b7780470f8c1e8100dbf6048e557bbe0aba83e26d279af564d28c06c08e170388ea0965cbadb9f1c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580838.TMP

Filesize
871B

MD5
39f7e54003cfe95eb92b2b8b2c79362b

SHA1
3707af7687241a2eca3370dd12db3137d1cf17ae

SHA256
2ffec88fe2d0fb8430cf2dc68063f2689729ea212c984ad4acab33cc8342cfd2

SHA512
b7fc1ce82c728528c7682f53ccfb315be1a0e63f61f91951559a53370d256db8ec142da406530da92a0818722f752fee87edef43e8799ef9b25c4363b37fe1e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000009

Filesize
17KB

MD5
913728da90cf90d8e78af59c60b47c3d

SHA1
f42f2a545d4fcaf4f76d0f060f52e33a47df7f1e

SHA256
b0b478f9aa6aaf8d5811e296047ae1f8ee07f4c4998fe9d7b960755ea1fafb82

SHA512
3af86e053dd56aef03e6f967a49b1a0d492616a71e2e49090e0c8e5cbe58ff37ccc55e91f06bf34096059a49f3de84b0bca587f3f17c366f97c0f7a0fd17c974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a361e8a489ba2044607f70e08e0449e

SHA1
d566578bfc7e1901fd93d520abcd933f7b904036

SHA256
6c62ea98ba105b49a9524e14b9976ff45ad2bfdcb96a60d61e463fb7ff1a17fd

SHA512
9cfb20999205fa177d524fdfcd4528699f699ab6442660c9261d722ef9568b696fe6eb7bd40245fd556c9570c55a1857fc2a1b273da3910d650b97869efbbd27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5cbbece0c5f5b6d13245c2346c97a81c

SHA1
2253f0e73167b057d6bd1f827447d789774db967

SHA256
f7274ffe8c824b4120f472fcb26679095b7da81fb39693af4481b16d391a9676

SHA512
16fe6ab6dc9bfa8a986a2f6a4c69f8988ef386ea05b78bb49bb4fbdf089d0961770443408e3a7c144f69a6779eb790f75772cde41da3d0d1f8ba4bf01e5e6ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c8a8c6b465ee00827b58e7b9f93f0487

SHA1
1abfb2fb985f6209dbc0d5e971dea0b0c24476b4

SHA256
895f14f1cfb307dcb4f14134cfb86fdb50e1e84b15b396eb77ba5fc1f9edcec8

SHA512
f80e85c7d73e6f00648ae6e7ed636db149b127f2fd8ab76602c14f6702980fbc5b76a8201e9e66a90264cc946f16039ff9b28510b496da48c8b6e3f05398a1c1

Download Submit
C:\Users\Admin\Downloads\Mirage.exe

Filesize
1.7MB

MD5
212e530f44461b39eef6176255f1d796

SHA1
d29d9ee8c194c2614863d54a41f944bca8d6297c

SHA256
3916431d1c50fa7b2d3c25a235e2fd9e50bb4c39cab14308563493ccb942dd9a

SHA512
1c1a409f2cdaf60665bbb9af4d68e9433825e1a093a319feaf5e85b344f76a8a84bc7ef9c4ebaf74c0a0d65bda279859392a4962ebe38cf85e1930f283ce0b5f

Download Submit
C:\Users\Admin\Downloads\Mirage.exe

Filesize
9.0MB

MD5
887f489ba990176ee78040d68b3087ea

SHA1
a25c24b43974322e7051556fd9a8a0999675cab2

SHA256
694a9777a9c259477974fcc8e9b3b6c6b193e4e905680898f30f4d1cca9031f3

SHA512
d6db1710fc8dbc335679def539e24519fb5e815e0292f01aa9c67aa22c6e49dd9ee69c6f5a9b767715edf26c1246d18fd0727d36fc40a57d900fb5b2221de03c

Download Submit
C:\Users\Admin\Downloads\Mirage.exe

Filesize
576KB

MD5
019fc185b05dff9290a3be104994312a

SHA1
ca720aa08b464b1130cbe0f58cddb46da5951272

SHA256
355a22c987df06728bfcf6112b276b865378e17560421a20bb3bd49cf174e133

SHA512
602bf900320e8f48536fd26e9ad939775098902ec4d208a610ec0e8d97b9791e4a042ca5ade53f4382566191d15ba74a4342d38f368f132055a224e9a075f88f

Download Submit
C:\Users\Admin\Downloads\Mirage.exe

Filesize
320KB

MD5
9cbc985784f398086348530ee157c8a5

SHA1
41d309a9db6652b58413904ff29cf533feb5f235

SHA256
78483feedb3323e349f93426ad7533c2179ec839c6008baf0f6bc7d80c405c6c

SHA512
7f53fb8c281b9c4902d709ed55d5b79b28564877bb413b44e872d22ad1441f228c2f50a081b0dd3b4da9f072d0655f852dc02a53e640116ef5af9d177cce03bb

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 492629.crdownload

Filesize
9.1MB

MD5
f7540559a79722567c438da1b77ccd34

SHA1
971b649bee59ab79ee7f34611f7d197912b8a69b

SHA256
912c26d0160b094c3ea9341374836c24119f83736b673323b03204bde2637678

SHA512
abc9129916797f10f0c18659e0f50ed3fccb0106673ec88ce0c1819cfc17dcf63442c72cecaef853c2226ae5f141331f8585243b41b6ad1888abe18cd8729f46

Download Submit
memory/1512-901-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/1512-898-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/1512-921-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/1512-903-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download
memory/1512-904-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/1512-902-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/1512-905-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/1512-900-0x0000000001230000-0x0000000001231000-memory.dmp

Filesize
4KB

Download
memory/1512-899-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/1512-924-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/2292-1121-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/2292-1122-0x0000000001470000-0x0000000001471000-memory.dmp

Filesize
4KB

Download
memory/2292-1133-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/2292-1132-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/2292-1126-0x00000000014D0000-0x00000000014D1000-memory.dmp

Filesize
4KB

Download
memory/2292-1127-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/2292-1124-0x00000000014B0000-0x00000000014B1000-memory.dmp

Filesize
4KB

Download
memory/2292-1125-0x00000000014C0000-0x00000000014C1000-memory.dmp

Filesize
4KB

Download
memory/2292-1123-0x00000000014A0000-0x00000000014A1000-memory.dmp

Filesize
4KB

Download
memory/4460-881-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/4460-897-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/4460-876-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/4460-875-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download
memory/4460-874-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/4460-879-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download
memory/4460-1119-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/4460-883-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/4460-878-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/4460-880-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download
memory/5012-907-0x0000000001160000-0x0000000001161000-memory.dmp

Filesize
4KB

Download
memory/5012-949-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/5012-908-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/5012-927-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download
memory/5012-909-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/5012-911-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/5012-913-0x0000000000400000-0x0000000000FEB000-memory.dmp

Filesize
11.9MB

Download