3d4b12a521eec58b89593bf50e2fd12041328d6b06fffcd870fbfb3face58d54

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

public.html
Size

178KB
MD5

63a44191116a90527672d2588ca2442b
SHA1

b92610e8fb0c495f39891082d8cfccf887845f84
SHA256

3d4b12a521eec58b89593bf50e2fd12041328d6b06fffcd870fbfb3face58d54
SHA512

1bd4695885ba3364fd7a256dc1e7ee9e766645ccda2e99821e5dbafc589eed012ef91acda9bcb7dd3f770316eab41c22159096934ba2d39155bbbc86a776566d
SSDEEP

3072:DfUWypsz00d/SPUEH2B3+3ZIPfaYcgU5Ffx8EP32XN3jPeFyJN/mQ9QPJmvtr2ox:LUWT0w/fEc3+3ZYw1x32oyfQAOIkM

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
4824	MentalMentor.exe
5936	MentalMentor.tmp
5752	MentalMentor.exe
5784	MentalMentor.tmp

Loads dropped DLL 4 IoCs

pid	Process
5936	MentalMentor.tmp
5936	MentalMentor.tmp
5784	MentalMentor.tmp
5784	MentalMentor.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-259785868-298165991-4178590326-1000\{06E5D91D-3C7E-49A1-A195-BF0458AE7B49}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 839478.crdownload:SmartScreen	msedge.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	207	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	208	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
1500	msedge.exe
1500	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
3396	msedge.exe
3396	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
4884	msedge.exe
4884	msedge.exe
5936	MentalMentor.tmp
5936	MentalMentor.tmp
5784	MentalMentor.tmp
5784	MentalMentor.tmp
5936	MentalMentor.tmp
5936	MentalMentor.tmp
5784	MentalMentor.tmp
5784	MentalMentor.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 216	1500	msedge.exe	84
PID 1500 wrote to memory of 216	1500	msedge.exe	84
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 1788	1500	msedge.exe	85
PID 1500 wrote to memory of 4460	1500	msedge.exe	86
PID 1500 wrote to memory of 4460	1500	msedge.exe	86
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87
PID 1500 wrote to memory of 3908	1500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\public.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc83c046f8,0x7ffc83c04708,0x7ffc83c04718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=2032 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,12567627600156268581,3333487066266127352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Users\Admin\Downloads\MentalMentor.exe
  "C:\Users\Admin\Downloads\MentalMentor.exe"
  2⤵
  - Executes dropped EXE
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\is-74BO7.tmp\MentalMentor.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-74BO7.tmp\MentalMentor.tmp" /SL5="$90224,2483849,845312,C:\Users\Admin\Downloads\MentalMentor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5936
- C:\Users\Admin\Downloads\MentalMentor.exe
  "C:\Users\Admin\Downloads\MentalMentor.exe"
  2⤵
  - Executes dropped EXE
  PID:5752
- - C:\Users\Admin\AppData\Local\Temp\is-50683.tmp\MentalMentor.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-50683.tmp\MentalMentor.tmp" /SL5="$F004E,2483849,845312,C:\Users\Admin\Downloads\MentalMentor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
65KB

MD5
d37a0b50e8cbbc3de35d3d1e9e1185cf

SHA1
c898ddfa3f2c551980ab4bef4a463c3fd11021b3

SHA256
deb12434ba06baf14aed67ee8aa28f48ae856f3792797eeeab1ee218754caf04

SHA512
d52983a3cd1343454bb9bfecdcdb76791a93b15fe83a46a62ca668041fff818f94815b6c596c2794972e11df3f4139a86e480578cd5e332bf9325e6e5e1572ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
19KB

MD5
2857adf1a9605ffe485d8fc987dd9fed

SHA1
94e412468c687d6c43dbb9427cca3eabc23944c3

SHA256
bc7f037334953f85a56ab92753e4bc429815445ff54e727e9cb69ed097d5161f

SHA512
012e1b52dfdf8dc00633569ff161662133d37cca4df26cbbc273b0eb6cfe52c1054fc8d5036dca26d754fe21e014f5e978f334f4abb5b36e831182489272fe14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
920217bcf84739847d0b9154af7960c2

SHA1
b16b463eaa4a812cb95f496ea006d8fb81b49716

SHA256
0af101993e0679e97b9f7ae5cc3bb8b5166d3e654e8ba999c100cdbb21b91d09

SHA512
b201e9d31b183ef6077c40d4bb0428923e3991c4ce2da8e76fbb8f8e76f77f2c0b424699d0c6723db178e94f5abe3a44fe145d0f13ba18c89464a0adcfa29f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1885f6a7221c6119b481ed8f6a48a964

SHA1
b430513319b827c564829c2a48ecec1fc8890b45

SHA256
604fcc871da81ed826a2e28903be5dcffe44401ed12474e445bcc95b0c9b2e4e

SHA512
1774997a806d325cacb6732fdbc78a246b1a27a1977728cc431358f918e1411b240b9f6bc88253e5ac507e36d87572ce213dfd5e8b2f31f3fbb0a63e94285d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
29fe1268ff4ab54212054563d0987da7

SHA1
03a826ee667a5eb9d53a0cb8b691540a472dbd98

SHA256
f04a77abcd7cf7024a9643bee11cd27b7d60b4b391c72f01c20fc623c766a8da

SHA512
5aae8d1af9954675664269996df61adc7b459cc1abc5cf3a525e96d08a480c298993dd5517767b399c7d99f015b8f18247695a5b8fffe7cdcde16fb7d82a03a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1dd5b9e011d22c50e98dc5a9fb036472

SHA1
10e05fa118f9c1a8eba5867455e3ceea6c958f8e

SHA256
43470cc82518b3e8f485170ef786ddcef1401740574ec1a6ed85263289b5edce

SHA512
d3933cc649293e3b4c38917503c4cf346d96a40d8746a21ebab9f178753a416ab68f3ef68b4e31311f38892b2cae719955b555b785f82d60ecac1e8fedc94d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f51d4e6dae14b451de3902f659c70a20

SHA1
7c0007b8cae21c1456881e1bc13d6fef3adf0705

SHA256
c0c89d9d22cac0dbf5a0e3a4bdb13e4edf9357d863e7a13b9dc9475a658668aa

SHA512
9d3d0fec21dd3df10b0fa558505da89d0bfe93165c42a68af0e126cddc9d6b684ee528d1ef0a74b96e4ad76218c2b9282181f77356dbe6a3cf8199f3d63d061a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e1c8961160613c3549731ecc27db727f

SHA1
6be1ecdb4e319c65a09237c056bc1510ce79a3c8

SHA256
7e1aee72335ab44618a471515c58fe18c1907a3c1c485617dcc8295e3e4a31ba

SHA512
8b2e8a23637d7f9cd95100b788ea2b1b369eb964950213d5fdf3a66d61ba0c86d17b6a45c83d9a547a570922aa37056758ed146b9ebde05eaff4848e6d80ca27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
94a532d76ce85c26dc77038c05abf357

SHA1
fd91fc9545de759c59125d1db7b2536612bb18a6

SHA256
7e15082c8feda1cf1486b1d91f70b8cec92ec7818dbd5706f886ef78304fe930

SHA512
02f37a467a33720143ca9da3e3bba0023105be531a399889cbf9dc52a64eff9202b55bb1bfb908a5cc02171fff6551db578d3257b4cb44bbee93c29b654562b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
aae3fb4242f837ea7093200e39975bc5

SHA1
42693e36c529f8d315512a48bed28a248813bfb9

SHA256
a81637747db23af787f82c52ffd9820ef3878b7839cc38bfce8d544da580bf5f

SHA512
bddf806ad6f6ba36a650efffe98bb2bd14aed5fd7c03f89f18b134473cd4e25d4dfd0c8e31fa35cbd61933fb3a14b6e634e9df6a726df941341ed72180bb0f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a01a382615abe6a7f0d26c627dd4b686

SHA1
98f3304a495fe56a3b50932ead7f86832b6f97aa

SHA256
f7a924ed32082382ea74ee73c9a1e92e498cd3cc708e642aca4a0406f06684bc

SHA512
7b32c37bbd281b2d2328b39c24171a68fffdbd81fb189d140de0acde4eef4cd26e1430d7cb2ad2ca63ba07f2a2e6af996d5bb2e2418d40d31ee5cbb1c9666484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3012be63022ed40bcaf4b6a991d6c52

SHA1
7c1f4f90731818754ebd6b436f1b90292b3f5687

SHA256
e5387a36161887f6ce5a24ce78e57c0b3c49dbf917e502fe935c27d7cc88ab2b

SHA512
9773608386242a844ba840a6a6eda86b29748775be2c725ff97b86d07c9c85ee2d220e3d191ebebff76ebbf1883e65062838d771ec0e43d4ea3d9a6529ff31d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ecbf1ea8fb3757f623267a3512f5436c

SHA1
d4f813de72d9196b01233ac45e99813d15d0fffc

SHA256
183935abd7bc9e661ef4e84cc39c0bfe64c0cb39daa2831b4bc025b0424c0fa2

SHA512
092e89fa5daae8899cc26bba7f1c116610c6a45fb263978a7ef14dce85dbcecd0419b10abd664183fb6d136c5e742fc33e73d0964a0c12fa25fe4c79a0d8f8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e3e6aad43875d1f86ec36d89046ba9f4

SHA1
2ea499916ba8359f62a40771e346761028448a78

SHA256
1f459af7d7e3cd9a414a5e750bda98a905184158471625e1d6b242286b2594f2

SHA512
d62dfeb983ff67e2fd3b136f1d7f6380b2bf619db213f4898815cf6d11796978f0a2bd806334acbc226e3ee1cbce81795d4594db0008a2a4e7ac719c01b616af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f7ae.TMP

Filesize
1KB

MD5
8039f83b0cf13a8709af3bf228639b70

SHA1
2f3b05c2c5d87d927a778b0050e11075b6d7fc53

SHA256
ce470e0944bf7d71951ed9b31e16d0bbd90c184009b481b9dd1ac3362bdd7ac8

SHA512
c8e081dca76104e7868623184ef9ac0880c95542e8742a556e106f3af699df6a99d23c600c6403c6829e839aff6c0b03954663a910eb6ad0d35a2bacaf171d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7be108d840ffd105a9a8b2048b394a64

SHA1
cfb2eabb36ba4fbc5ebec651fe94c8227640a0c8

SHA256
7446db00db5b097c63bb17769cf8d216ab2851ecb09cfa4e8e2712ba654476d8

SHA512
abb25e18e0344ea7c073cd0b193d445458b510997b0b21036a11d80e342a28d74f7365937c92942a4ee4962c7601ce394c1f719d9894df27c91b9721e46caf5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e9f456649bb28b2d66247357e7b64223

SHA1
594afe5805f87c5e9de240ed1792ff68119bb6fd

SHA256
a29ab4ea8932ed8f9db8cf55f057b2c4c82a56f1b3a7442eda256a2aba312aab

SHA512
16856e9ae49886bc0d784407ee81217126a8ef7585c3fe2e17f55fc09f24c68de44f03317e8704b42f0b1f273c2e2fd22ddace5df1a2a4f125ceb1fdb098717b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
578ec3366e7de0a68f9f01ef23329e72

SHA1
c34123d196f11e1fed8c413d99b300383c59c2bd

SHA256
78f700c98f2750532418c76dc16cb8991863b16b37927c4977eda292ab0dd3b5

SHA512
3440d1b7a7e238a4bd506959adff527f539c85f53bd93bc61f70b0c4bc938d5331271557105cba8e065d0b8cde54c850b41876db5d68fee5b0e771c8c3b0619d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-74BO7.tmp\MentalMentor.tmp

Filesize
3.0MB

MD5
0d041f22d598f3a63bdf0e66c448bdab

SHA1
591fc72ec32e7efe2e641dba38c3cd7b6d415450

SHA256
e6b54015c403e3016b848b18fc488d4d281a752bc9ab2a3324ba4d8efb642563

SHA512
5dd3af37f06f308f348213c0305acab38cf279556c12a9b14d0343072b1f431778c75129715a2b04abcf219baaeba665faa08fcb4692d2ede36b2511178de210

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-F9R5M.tmp\idp.dll

Filesize
2.6MB

MD5
4ab254c4ac23cbebe88300ee3701971a

SHA1
50f3a954278872212fb7446d3145a3cff2aafd6e

SHA256
abd2b6318b0fae420b5e9a8edf7fdd8691cc929440bfc5d436cb4489b9ef534a

SHA512
3d7d03099036e6e0fdead14617f65dfee7048595f4bd82ad8f2158333255839e3f4efe9e783b39595f350207a90282cb5718f4cb71a3405d79b027a6ff5ff411

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-F9R5M.tmp\mentor-inno-lib.dll

Filesize
269KB

MD5
cf8b792e9b7b1486710a86337717cba3

SHA1
feae21175e7a00e23eaa4a2205be82104c98b062

SHA256
305cb219908d900b62fa8b633d05bb7d64d781b6c75210e45c86232235da6073

SHA512
9a201ecc938a818b4516850c29b1fa900a83e201c2160f5f23a0068e5d96cea6bd0b635b094dcfe33bc9feec0ff92201cc6dbd4ca77c188d053ac669751aac83

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 839478.crdownload

Filesize
3.2MB

MD5
4403cb3b8b299528d40a2555d8395beb

SHA1
52971b252d0e259808f158872db478eef4ed94e4

SHA256
cad92559e7848f000ca084aa6e5434a2eafedd2bc2e5ff06a13b724bfd447359

SHA512
a1bd42758a68499dbce08cf99d6da6cd526914032a8129869da40c28f6daa4006b26b24047d40d0e4e11e325c97cef603172d5029bfda4756d5b94f0454fdb18

Download Submit
C:\Users\Admin\mentalmentor\settings\temp\install_config

Filesize
1KB

MD5
2ec543a201b55c6bb334c092b074ba8c

SHA1
8cf4215152781ebadffb427134e14d3ec5ab2dd0

SHA256
a5fd86140b8bede16304c7484d70b03c03a000fdb4adcb124b4bd7ee6f30a8a9

SHA512
aca533d4082ff5597b8a55c0f91d81ff7db617bf0983f139043d58871c2e2c8f33edbd6a6ff2ca83ed176191bdfdfeffb071cfd1ac3d4ff0a9ac6237bbd0fd38

Download Submit
memory/4824-570-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/4824-630-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/4824-568-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5752-648-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5752-577-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5752-632-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5784-602-0x00000000023D0000-0x0000000002510000-memory.dmp

Filesize
1.2MB

Download
memory/5784-603-0x00000000023D0000-0x0000000002510000-memory.dmp

Filesize
1.2MB

Download
memory/5784-595-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/5784-633-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/5784-646-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/5936-589-0x0000000002420000-0x0000000002560000-memory.dmp

Filesize
1.2MB

Download
memory/5936-631-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/5936-590-0x0000000002420000-0x0000000002560000-memory.dmp

Filesize
1.2MB

Download
memory/5936-575-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/5936-653-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download