hxxps://drive[.]google[.]com/file/d/17ywQMtmmQLBMVXSOfh74jR9mzGqJZVAH/view?usp=sharing

Analysis

max time kernel
232s
max time network
240s
platform
windows10-1703_x64
resource
win10-20240404-es
resource tags

arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
20/05/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/17ywQMtmmQLBMVXSOfh74jR9mzGqJZVAH/view?usp=sharing

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6124	PlateUp.exe
6072	PlateUp.exe

Loads dropped DLL 6 IoCs

pid	Process
6124	PlateUp.exe
6124	PlateUp.exe
6124	PlateUp.exe
6072	PlateUp.exe
6072	PlateUp.exe
6072	PlateUp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
77	drive.google.com
78	drive.google.com
1	drive.google.com
2	drive.google.com
3	drive.google.com
27	drive.google.com
28	drive.google.com
76	drive.google.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606400381393686"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "4352"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "5429"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "422947965"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "23"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e98b541b50aada01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "706"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 769feb1a50aada01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "589"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "5429"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = a04660d536cbda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "233"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "544"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f70a2b1550aada01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
940	chrome.exe
940	chrome.exe
4068	chrome.exe
4068	chrome.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	392	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	392	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	392	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	528	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	528	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
784	MicrosoftEdge.exe
4396	MicrosoftEdgeCP.exe
392	MicrosoftEdgeCP.exe
4396	MicrosoftEdgeCP.exe
784	MicrosoftEdge.exe
784	MicrosoftEdge.exe
4548	MicrosoftEdgeCP.exe
784	MicrosoftEdge.exe
784	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 4396 wrote to memory of 2488	4396	MicrosoftEdgeCP.exe	76
PID 940 wrote to memory of 4612	940	chrome.exe	88
PID 940 wrote to memory of 4612	940	chrome.exe	88
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5300	940	chrome.exe	90
PID 940 wrote to memory of 5308	940	chrome.exe	91
PID 940 wrote to memory of 5308	940	chrome.exe	91
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92
PID 940 wrote to memory of 5364	940	chrome.exe	92

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://drive.google.com/file/d/17ywQMtmmQLBMVXSOfh74jR9mzGqJZVAH/view?usp=sharing"
1⤵
PID:1832

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:784

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4412

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:392

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4548

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4524

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3908

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xcc,0xdc,0x7ffa7cdd9758,0x7ffa7cdd9768,0x7ffa7cdd9778
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:2
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3596 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3784 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4600 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4720 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3780 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3020 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5284 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 --field-trial-handle=1856,i,14430281879298712386,8144828646360034083,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2712

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\" -spe -an -ai#7zMap31645:116:7zEvent23831
1⤵
PID:1512

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\" -spe -an -ai#7zMap4521:116:7zEvent15645
1⤵
PID:5164

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\" -spe -an -ai#7zMap25279:116:7zEvent32006
1⤵
PID:1588

C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\PlateUp.exe
"C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\PlateUp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6124

C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\PlateUp.exe
"C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\PlateUp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
2450a784c33a439624322b2360ae0d87

SHA1
43c0879c4d6b198a1c542ae019db166ad03b86bf

SHA256
84d205af9b6373d3999f6a741e0aea5ee56ed3d3c215832c6eb35d6864aa9bcc

SHA512
f448b2018a54708be2b744542b3cc596df3cdb08547588867af07e15de045b6499a171a5dcb0f127c143be5316dc6a8982466f662042b8f7b420276da107e064

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
eeb75d7a0a1d0439516a041462ed795b

SHA1
b7115119d7934171e1501dd027e9cfcd4afd4936

SHA256
2320f90c4f352455504b058e19a9b7375f6b1c2ab71dde9f0839889b3b481e18

SHA512
12f6c54b66c450a6cf7032b641310d6e5106ec84a16d2ec8055181cbe2c8645508ccae7740cf4fd7e4283f9c33d03d8e82ea9dd372c6f14f72396885f13499ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
e0c02886983a192a48ab25c3167b28ee

SHA1
344c0629b8e4268e53a6b875a8b06a7181be2282

SHA256
0a79a1f27008aa80c50717019e39c846ae70765e159347ae96f20d51ce14d0be

SHA512
963f1437554a0f95534440f0178bcb4d8b6021df8a4a3887cd42331b80f7d7ba1e0b5e69d33011b585e2afb13890d14e5ea0e60e70a8510c0fff0273df2cb342

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2c1f4e11a32a727adde87c0baa20d364

SHA1
680de2188b064692bc2e2ab0d131afeadc80237d

SHA256
3d505d7080e983cfc340401755e91f4aa02a06892d0a7426ca3430c5c9487928

SHA512
a3881a33f0eb4f4dc066e1e45f79a398357d7b1e39af497d99aaecc06a5a5214326953935b1dd8a83578b0c021686ee6b0ef01fe5266bba52f67b6695fd26448

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
560d57601d619d31f879eabbbe883b87

SHA1
4dbe85638b6c65925e442f6f14739e43343f986f

SHA256
51783d7f0d0318b256939c43039547ff6523e6e45aa0a635d75883a59f7e7706

SHA512
e2ef42e3b923a8f4b67477b4838ae87bb542b798d028545af0f18243f5210eade805ea3a40dd22368b314fbb6ad642b5d387e1a5077e44ff4a3ef610895a440f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
08e6ec8923cf411db10ebfd406af4476

SHA1
6ee92184aed50b44f1568dc1b9c7d370e4fbb659

SHA256
42fcfc8ed20a5642f20e0145cc57b228efcf91f39a0e5c803090e759afe6d53a

SHA512
fb99476f9822282cde01fc34cea6629bdbd8052b0ded790e11e43be3149db7f354289d9ad4e24f36f9deb39f42aa19f6492b1afba2b7e598d89b716e5cf3b8d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0c065e35b4397c3db76024dbc6b4a5e8

SHA1
723982ebd698d1c8a85115d14160de2e31d98896

SHA256
4ead0bd83f36c6231191708aa395ce160996b22430bbbd07a1249061bd8d83d3

SHA512
7f8bda8858937b0aaf835b2df14b8ecf5c61b528362a57030f72d9ad1c35bd208944dcd00c824d5e4a048c9c5d026632dcb3abdd69eb9957b0057639a033926f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f069d58f3ca7058fa377a17294e22a14

SHA1
4abf69f518490705ad48365c0a988bc71ca00a1f

SHA256
13b40871561580cb5c8677e96bfecd6efa4bd4af2eb5a082426d471ce444183a

SHA512
0e0166525eac151c880919793425b50516bf1081e911e5519ca75d850a019360e89f1fd85467e174a585c54144b31ee85d0eba9bd2501d5cdfce0b5e39e9e52f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
b18b91a13f01edc9888a4bfc75b04121

SHA1
5482439fdd1a20b57b8bc6adab5a4eb320fa6299

SHA256
485a42bbf923de23cf2bd5339cb33bb906206a0b0ab5f08e65892bce387b7c61

SHA512
2543564d5150aa6046550a2c71ea5bf7d7bd2fb19efa23ca909dd075674aaa1c781005144027deee2e13c36fcca7bdce2b76d027e892ef3e862fec92cde23715

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
276KB

MD5
786f71cf5ade7dca261b8762fb26ecf0

SHA1
06b0302ebf95f4679360b7e4b9530f49fb65e203

SHA256
1ff1a70a4b08c12bf1ab70fcc276155a6cc2798cf594e209e98aac245413e281

SHA512
d37d4ea09ac308017d6843a4bcb3ecf3d02d0472c6ae69c465035763e2e45ade9b427aee64bc66fb4b6edf85ee174e6e4e1d850350a659dde1a85abad6a58c74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7BUKSPQ\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\JM7HRLES\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\0JP6ZKWL\www.bing[1].xml

Filesize
1KB

MD5
19cb23a180d3e9cdc9098a9ce0685879

SHA1
72398f63d60b6ba79f248f0e5f49349fa86d80d1

SHA256
6b278e300c3f0161601fde11aa301f40a3fd0b263d7abe782931acc86a6d0c7d

SHA512
95f869e4aa57d167c01b9ead5b7b8661796ac32619e52c0061ecec5696a804b7e4b28b13392566f091c632480213b29b3696966275b59330c3de2f6ac9f4927a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\86SXE0NB\drive_2020q4_32dp[1].png

Filesize
831B

MD5
916c9bcccf19525ad9d3cd1514008746

SHA1
9ccce6978d2417927b5150ffaac22f907ff27b6e

SHA256
358e814139d3ed8469b36935a071be6696ccad7dd9bdbfdb80c052b068ae2a50

SHA512
b73c1a81997abe12dba4ae1fa38f070079448c3798e7161c9262ccba6ee6a91e8a243f0e4888c8aef33ce1cf83818fc44c85ae454a522a079d08121cd8628d00

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PFSBEUN4\suggestions[1].es-ES

Filesize
18KB

MD5
e2749896090665aeb9b29bce1a591a75

SHA1
59e05283e04c6c0252d2b75d5141ba62d73e9df9

SHA256
d428ea8ca335c7cccf1e1564554d81b52fb5a1f20617aa99136cacf73354e0b7

SHA512
c750e9ccb30c45e2c4844df384ee9b02b81aa4c8e576197c0811910a63376a7d60e68f964dad858ff0e46a8fd0952ddaf19c8f79f3fd05cefd7dbf2c043d52c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A

Filesize
312B

MD5
129107efb18bbe46bf927cb887928aa0

SHA1
2042aa26101c16f281758aecaf48ca98183964dc

SHA256
c1194276f8462094128bbe8946d2d3d2dfc059e4aa09cd78155f128c5d0de3a5

SHA512
bc18b3e0dbcf39bc6cc38a8e32430c7131b7c271757dad25dd24487bfaf59f31cdb02ec26fa187237b9b92bb2bdb9594aa11d6ed04f719d97a5677c6b10316df

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A

Filesize
404B

MD5
1b2696f9c8d1a8c1e22ab20a8487b6cc

SHA1
12d664aba08f1cc1b493a674fc87d68669ea5f80

SHA256
0a1090a0089a6b0e34c8a26fd004f26a78681dd56f03d994039a6f3bd542d6e5

SHA512
7553b1f6fed108b3f6014fa181cb4d7fd7abb5ec9e238a34068760a46c33f1641b8af8ed06bdd2d9d6a3819cf020ad5b2ef1071c8d9a372edc1f379a1e2ff66a

Download Submit
C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\PlateUp.exe

Filesize
638KB

MD5
e4931a612870655740408e20592e018d

SHA1
c90993c47ae8f6df1e9ebbc32ee7bda923893e3f

SHA256
0129cf5f6134642a27bbe449107111d9b01beff24abab41bd85ca2c01ecdb6ef

SHA512
b7a2d757f15d4fa7ff9dc9ed57cda5dc0bc6e07c9d9a85b3ab83de4ba7c56473076fa73233cf8315c33d5773b8e296664b94259e0343810eaa63832d39c56477

Download Submit
C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\SteamOverlay64.dll

Filesize
96KB

MD5
549eb651023fa847d2212bebe29c6f9e

SHA1
f70fbe8f46cbd90c185eac2a2df843e2c3405a8f

SHA256
9edeba9df599d65fb378d4bcbe16e9ac2ea3b7850491e662e8ddaf6f1d74849e

SHA512
9e249b8d589c52857362b0611c265c21d1f715749e6b7a75e112d28aec89975655a8ef62ad1de812fadd39a48f0e01cc8eef9e33bbb5e30da827020c77247c68

Download Submit
C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\UnityPlayer.dll

Filesize
27.2MB

MD5
33e9cdaf2786d7d0a9011e7d4c6d08e4

SHA1
5a73de81f530117bdc53b07ac5703403cfc74e3e

SHA256
cdf1d93b3c058f31007a929eded74363b0a0a6e85e60ff9f80bbaf59decbf3d9

SHA512
69ec70b227d32a800c5bc22c34c02c382b403a0b28cf20b3fff14a7653dd29e131476334b4119b867818125cc60bce0f03e4900df090457ab48409547606e5f5

Download Submit
C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\WINMM.dll

Filesize
257KB

MD5
c5bf99bc699a12c89783ec83c42a36c7

SHA1
acd45b08796a4932ae7ad3989c571993ebcf0352

SHA256
54a6ece54641ee6e437caa351e493ddf4435f3e23e3d4ab4655c35f57b94fc59

SHA512
2d86cf49181d66e2747dd6f8ada8eb0646b4a9767d4dc2ad5dfeed5c9737543693855a43c6c4e19334bad6116157caa0344518d2ca803ec0882ea630d9d32ebf

Download Submit
C:\Users\Admin\Downloads\PlateUp.Build.04082023-OFME\PlateUp\dlllist.txt

Filesize
35B

MD5
ff98c62757cb7c9f5dbedcd67d3781f6

SHA1
82076991ee9a824bcf9969b416fcc163d02a6160

SHA256
662dd415e2796635702c49586fb99ae62a3c6f595976d6923ec8a4e7c23fa8fe

SHA512
42973bbb4feb375354684c0356c45bfa7f0bf63056906244c2c0ac89720326cfa41c9aa51e2522d1d9da66c019ccf3dba570a732007e8b3306e66920faaae791

Download Submit
memory/392-45-0x000001B7AFE80000-0x000001B7AFF80000-memory.dmp

Filesize
1024KB

Download
memory/784-16-0x0000029F8A520000-0x0000029F8A530000-memory.dmp

Filesize
64KB

Download
memory/784-0-0x0000029F8A420000-0x0000029F8A430000-memory.dmp

Filesize
64KB

Download
memory/784-35-0x0000029F89580000-0x0000029F89582000-memory.dmp

Filesize
8KB

Download
memory/784-357-0x0000029F90BF0000-0x0000029F90BF1000-memory.dmp

Filesize
4KB

Download
memory/784-356-0x0000029F90BE0000-0x0000029F90BE1000-memory.dmp

Filesize
4KB

Download
memory/2488-341-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-337-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-333-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-334-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-336-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-340-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-342-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-343-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-344-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-346-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-370-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-371-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-374-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-347-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-345-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-351-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-348-0x000002AB9CEF0000-0x000002AB9CF00000-memory.dmp

Filesize
64KB

Download
memory/2488-241-0x000002ABB0300000-0x000002ABB0302000-memory.dmp

Filesize
8KB

Download
memory/2488-243-0x000002ABB0320000-0x000002ABB0322000-memory.dmp

Filesize
8KB

Download
memory/2488-195-0x000002ABB1000000-0x000002ABB1100000-memory.dmp

Filesize
1024KB

Download
memory/2488-95-0x000002ABB84C0000-0x000002ABB84E0000-memory.dmp

Filesize
128KB

Download
memory/2488-87-0x000002ABAF950000-0x000002ABAF952000-memory.dmp

Filesize
8KB

Download
memory/2488-89-0x000002ABAF9F0000-0x000002ABAF9F2000-memory.dmp

Filesize
8KB

Download
memory/2488-91-0x000002ABAFCB0000-0x000002ABAFCB2000-memory.dmp

Filesize
8KB

Download
memory/2488-83-0x000002ABADD00000-0x000002ABADD20000-memory.dmp

Filesize
128KB

Download
memory/2488-65-0x000002AB9D800000-0x000002AB9D900000-memory.dmp

Filesize
1024KB

Download