Analysis

  • max time kernel
    112s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 12:28

General

  • Target

    https://arahdrive.com/PhxDCXTyswuDkpf/file

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://catlackjellyodwps.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://roomabolishsnifftwk.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://arahdrive.com/PhxDCXTyswuDkpf/file
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0f5646f8,0x7ffd0f564708,0x7ffd0f564718
      2⤵
        PID:4132
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        2⤵
          PID:1648
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
          2⤵
            PID:2928
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
            2⤵
              PID:2004
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
              2⤵
                PID:1100
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                2⤵
                  PID:704
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
                  2⤵
                    PID:1316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5068
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
                    2⤵
                      PID:3220
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                      2⤵
                        PID:976
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3212 /prefetch:8
                        2⤵
                          PID:1660
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
                          2⤵
                            PID:1060
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1280
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
                            2⤵
                              PID:5216
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12439192152121259125,9035139012753163534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
                              2⤵
                                PID:5224
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2236
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1216
                                • C:\Windows\system32\OpenWith.exe
                                  C:\Windows\system32\OpenWith.exe -Embedding
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5428
                                  • C:\Program Files\7-Zip\7zFM.exe
                                    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Installer.rar"
                                    2⤵
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    PID:5712
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:1616
                                  • C:\Users\Admin\Desktop\Installer\Installer.exe
                                    "C:\Users\Admin\Desktop\Installer\Installer.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of SetThreadContext
                                    PID:5436
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                      2⤵
                                        PID:5992
                                    • C:\Windows\system32\taskmgr.exe
                                      "C:\Windows\system32\taskmgr.exe" /4
                                      1⤵
                                      • Checks SCSI registry key(s)
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:3336

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      f61fa5143fe872d1d8f1e9f8dc6544f9

                                      SHA1

                                      df44bab94d7388fb38c63085ec4db80cfc5eb009

                                      SHA256

                                      284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

                                      SHA512

                                      971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      87f7abeb82600e1e640b843ad50fe0a1

                                      SHA1

                                      045bbada3f23fc59941bf7d0210fb160cb78ae87

                                      SHA256

                                      b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

                                      SHA512

                                      ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                      Filesize

                                      205KB

                                      MD5

                                      e7dad746d60446e8ee63b3b9b0cd9e45

                                      SHA1

                                      2f323ad3c9158cfa6724db6d667eba115c0a2af6

                                      SHA256

                                      8ceda62270b0857d757458578b2c0bbbbbb67fee798f50fd0f99fb70f125b00d

                                      SHA512

                                      eebef793b2ad136060ac7bddb0e17cbd10b49c85b651769a818a5568997849c03cdf2ce478a407ec230f1374c68e91f362c1b9c809607bf4e0048cb7f3d6eac3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      336B

                                      MD5

                                      1f9ba31460351e02b5255b4e7321b7fe

                                      SHA1

                                      6256ec8ca9c606f4ba4b9d70987656943106e98d

                                      SHA256

                                      0a245dd4c6e2fc8c6a5a50b5d23481c4b667f4efbf51fb3af5cf53c56c419b46

                                      SHA512

                                      7cf205f7f3d27e08d3b50be8e5024eb35cdd45b453091d6c0b96c0e7986fab49e076def6b655880416ca86bac0abe550468a98d79078c143d38cffb3400cddef

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      a85f94c6f3d5a28da24749237bba86eb

                                      SHA1

                                      db569172664a85ddd24cf10b9f77fbe0aa193ac5

                                      SHA256

                                      bcc3349bd554b209d857bdcc845aa835bf8052014a8eab509023e87ae480dea8

                                      SHA512

                                      4f79a4098648e9d6b18878749c82129e49b63c9df918498d2fadaf2fd154dba41d5df21d0900f22ee055993fda8650e3e44968644ed7e51da57ecb9e880081de

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      a61b1b62c1572fe266720e6210a8f3ef

                                      SHA1

                                      11095a3c4a4cd7df453e68568e49626d6b3befb7

                                      SHA256

                                      bc78a00d12aecf3d0a5161712d87223387edfd18be9f5debc06ea8b8dc4718d4

                                      SHA512

                                      92242433e4b2bb4aa64e87599f7266c3a76f9402d3e4fa2ff8f59e441878c7ef5390ec5c5cf22cf2abd9263a83f81a1e8c7645a53039b4a0bd2166834ac9702f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      a0e540a01c8f296f1e64562bc09ec06a

                                      SHA1

                                      d69079479c4c2d61820682072126e8cff5a29553

                                      SHA256

                                      4623183432ed42d65d056a7a3fdc998db86fa5d8ea642dd16258150514248d7f

                                      SHA512

                                      15950822c8d1d01eacf0a90673c10da48be67fa929535563a837fbc2f06259037d51e382c44d3f06f4b0e4ce55ad84bde2aa9adccca99b47dc38a70d77e6858d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      ce4b10f477dbb6f38206c7abdb5d345f

                                      SHA1

                                      c8b3930a75ec697d194228319d8d4f610298a76e

                                      SHA256

                                      bde3e1b15fc8b96e395a88538ea2f13ae27d137c95de8403c4e4fc52c51cbad1

                                      SHA512

                                      ada77ba576893faf73499ff928b00f7c5504d555f459ea972c9b265c348f311dd03e4f76881c94951b2d209d9b73f9c1fe0ca9307785c7a1daf885642023b892

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      d7a0c4e13e01f9f78ca6f80019f7acd1

                                      SHA1

                                      2cd03dc984815bb6bc9f22984772a55e984ffa55

                                      SHA256

                                      45bfd7b71da9059a668d3f335e9aa33ac7f128a7ae0ac254eccc7b102b6c910e

                                      SHA512

                                      627c9eae8af78e4672a38ec157ae5d6879df66df6bf3e3b806821b72afa5984f62106befa7d241d5538e4781f6aaaf58f3328f9806382be970585864e8b394f0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      7772363d9a8868a00e5d05056351bf1a

                                      SHA1

                                      799aea2747043980315b3d74f459e8dd65d0bd2a

                                      SHA256

                                      3c78ff7312a9501b14e03c5a99f32a65b2e38302f8470bd1ce55dc1b69365465

                                      SHA512

                                      1578844e847dcc1c00c61236a5103af36c71e251e271327aeadf7967faf5d8bed847e57290a7de626266845984eb954313e72bcead4777d684fbb763cb45124b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      ee3a37d486f17fce437359d1c7b1b5b3

                                      SHA1

                                      ea9581ae1742bf5b940ff6ee033d081d40fbe285

                                      SHA256

                                      f0d360a974fd70416a41f0275f7f9124b8117b1fb4359cb79d3037e69721db59

                                      SHA512

                                      ae70b05b24f2a88383101bc3b6bc9682dc601319a60b2228b119a001c9debd1ad47152f0fb04320e04d216848fe412bde9072072d00e772b4004c6c71b69b332

                                    • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

                                      Filesize

                                      742KB

                                      MD5

                                      544cd51a596619b78e9b54b70088307d

                                      SHA1

                                      4769ddd2dbc1dc44b758964ed0bd231b85880b65

                                      SHA256

                                      dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

                                      SHA512

                                      f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

                                    • C:\Users\Admin\Desktop\Installer\Installer.exe

                                      Filesize

                                      4.1MB

                                      MD5

                                      45d681c380458cb3e5783613e3775f5c

                                      SHA1

                                      8785bd7c02cc56e4c8fd2c125e9aaf674c3ce4f6

                                      SHA256

                                      e26b304c0b700cd1d2308e8505faf5e685c2ed5b2a534c26a530a3b99ec6ece2

                                      SHA512

                                      88fa83946b30ed9dbaa3d18bf8d24c802ea6e758f84df854ebd24fafcc5bbae969dfad6738f7c57ee957d1f35b0a396495bfca2a343ebe342f1a073b2803e90f

                                    • C:\Users\Admin\Downloads\Unconfirmed 796759.crdownload

                                      Filesize

                                      22.5MB

                                      MD5

                                      6cf282fd0294b81925a2dafc2ebbe18a

                                      SHA1

                                      022e48d634bd7c92649f8524e1a4b3e7c70377e3

                                      SHA256

                                      df9ec3508d5c3902ca1b952330002a7c6843a69381bcf2b781a9d97f329bc8b4

                                      SHA512

                                      29773e310aefcc5a27a6a98e8633e52e79d9ed4bbfb1eb1646001d020eda8e6f7d0cf1b1989744e82847cfdc28c45f1e6f2ec17f664810e48b02c1f424bd68ea

                                    • \??\pipe\LOCAL\crashpad_3388_ULXXHVRTOTTXAKTH

                                      MD5

                                      d41d8cd98f00b204e9800998ecf8427e

                                      SHA1

                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                      SHA256

                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                      SHA512

                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                    • memory/3336-610-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-605-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-607-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-599-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-598-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-597-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-608-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-609-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-606-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3336-604-0x00000271540B0000-0x00000271540B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/5436-591-0x0000000007380000-0x0000000007512000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/5436-581-0x0000000005D50000-0x0000000005DEC000-memory.dmp

                                      Filesize

                                      624KB

                                    • memory/5436-600-0x00000000036B0000-0x00000000036C0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/5436-590-0x0000000005FD0000-0x000000000624E000-memory.dmp

                                      Filesize

                                      2.5MB

                                    • memory/5436-580-0x0000000000F40000-0x000000000135E000-memory.dmp

                                      Filesize

                                      4.1MB

                                    • memory/5992-611-0x0000000000400000-0x0000000000458000-memory.dmp

                                      Filesize

                                      352KB

                                    • memory/5992-613-0x0000000000400000-0x0000000000458000-memory.dmp

                                      Filesize

                                      352KB