hxxps://cdn[.]discordapp[.]com/attachments/1242945817900486678/1242951296374276249/OTPBOT[.]rar?ex=664fb419&is=664e6299&hm=0099c795892a247f6e50c3d801ff6743e80238fe4f7fef5cff8b770e30ca3af5&

Resubmissions

22-05-2024 21:32

240522-1dxg4ahe6t 1

22-05-2024 21:28

240522-1bcpxahd4y 8

22-05-2024 21:26

240522-1aczaahc9v 1

Analysis

max time kernel
75s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1242945817900486678/1242951296374276249/OTPBOT.rar?ex=664fb419&is=664e6299&hm=0099c795892a247f6e50c3d801ff6743e80238fe4f7fef5cff8b770e30ca3af5&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\Registry\User\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\NotificationData	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000009a58f07c110050524f4752417e310000740009000400efbec55259619a58f07c2e0000003f0000000000010000000000000000004a00000000008069d600500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OTPBOT.rar:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
916	vlc.exe
2000	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
3260	msedge.exe
3260	msedge.exe
1516	msedge.exe
1516	msedge.exe
760	msedge.exe
760	msedge.exe
572	identity_helper.exe
572	identity_helper.exe
2108	msedge.exe
2108	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3220	OpenWith.exe
916	vlc.exe
2000	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
2000	vlc.exe
2000	vlc.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
916	vlc.exe
2000	vlc.exe
2000	vlc.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
4552	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
3220	OpenWith.exe
2872	OpenWith.exe
2872	OpenWith.exe
2872	OpenWith.exe
916	vlc.exe
2000	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2040	3260	msedge.exe	80
PID 3260 wrote to memory of 2040	3260	msedge.exe	80
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 4640	3260	msedge.exe	81
PID 3260 wrote to memory of 1080	3260	msedge.exe	82
PID 3260 wrote to memory of 1080	3260	msedge.exe	82
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83
PID 3260 wrote to memory of 4920	3260	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1242945817900486678/1242951296374276249/OTPBOT.rar?ex=664fb419&is=664e6299&hm=0099c795892a247f6e50c3d801ff6743e80238fe4f7fef5cff8b770e30ca3af5&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8d4973cb8,0x7ff8d4973cc8,0x7ff8d4973cd8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,7788054190228843005,10479635622421815858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3220

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2872
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\OTPBOT.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:916

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\OTPBOT.rar"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9faad3e004614b187287bed750e56acc

SHA1
eeea3627a208df5a8cf627b0d39561167d272ac5

SHA256
64a60300c46447926ce44b48ce179d01eff3dba906b83b17e48db0c738ca38a9

SHA512
a7470fe359229c2932aa39417e1cd0dc47f351963cbb39f4026f3a2954e05e3238f3605e13c870c9fe24ae56a0d07e1a6943df0e891bdcd46fd9ae4b7a48ab90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7915c5c12c884cc2fa03af40f3d2e49d

SHA1
d48085f85761cde9c287b0b70a918c7ce8008629

SHA256
e79d4b86d8cabd981d719da7f55e0540831df7fa0f8df5b19c0671137406c3da

SHA512
4c71eb6836546d4cfdb39cd84b6c44687b2c2dee31e2e658d12f809225cbd495f20ce69030bff1d80468605a3523d23b6dea166975cedae25b02a75479c3f217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e3ea1a3cf9db35cca3f7ef7e5a502da7

SHA1
201877baaa9de13969565a112666548af6ebe7ec

SHA256
9f44dd0b36ce863f4e6f5d47450c7e6912719fa9c4c8aabee4cb68cbd0bb1a34

SHA512
06b88000af9a8bf946aeabf5491437e41e22d79a8841b7564b86e7297ead34d32e0679ba84b59e01ccac5d9b4d2d2af55717a55f374b615a847173301d7ed276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8d0d86779e46fc2e287e57fa520e797

SHA1
bb3727f2d8389fa87b38ee71707b46d7005e1802

SHA256
0165f0e6042b83d7721ac197c84d6081766e411080c13c8460c704b1d4bd65a1

SHA512
16d31d26d20f8450167d48211cc7df413fd9e99a2d985981786333591e4f66205b7f1283efcd1aed89a6317d3e80042e263bcd21a36d39f8645494f082703b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1c00482c581ea5464cc3cf802dccf06

SHA1
0943763d2269b946dcd7aff679904f26d58ad4a8

SHA256
b72d9323591e6ea088dddfde1d5475d1793c80dcbedb78babe14388ab6b9401a

SHA512
3dec69c534e817cbd4db7b20e2b2922b2c2e13a4c8e68bcfa2764406ba86f2115cb18ff4fb6ca1877879a0fe355758604f80f412d406d45dd897eb2061da1cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
671bd5c31e60ae9636515883e01c8a26

SHA1
cd5406255b08a49b79c8764bb8b47a94ca43d4e7

SHA256
709ba2cd85fc649bbd00b8c47757c618f2435d2e854e7e282bba5ab0af4748c5

SHA512
4577f2fdd0373898d7833b1771c62ba1f1d7fcbe86818d7b471ae869bfa94c7c0a8036909c208f13c796bf97dadb1e011a435f4f45dfe12f2e16232cad74a02c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9387710f652df6a744f31a4f8200f249

SHA1
889c220b4c046c1a4099da5eda4e2516a5d3948c

SHA256
52380c33c2b2b8e1d08dce24b09062df1e8a89df396b4865bdd3831f20589fba

SHA512
518d0d4d4e32ac5a8347c0d76becd53c5f8fd053986f33af011507ebb3e5ad68c349bbcfa19f2b504553b0c549ee7c8337bbc4fd48a2fab9a61c7b3a6355e5f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d6086c285bfb1095392d132a22d2a6ce

SHA1
f1ec90d4eca78abe2f232685de3e23bdba9b722d

SHA256
03e89f833c8e87d891ef638a32a980c8e06526f697e59ccd765468878414820a

SHA512
8d97232619cdfb4ecb6bc73f26e6a59b0ea9cee6863971daeed1605155833916560d356f7c666c902d43dc599898520c786239d563e861bb1a43e0c21b12f607

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
522B

MD5
7be4ae39b6a5ebbd784ee37d45f3f68c

SHA1
f4e4d57ee20f2860841469696e34176c50137f40

SHA256
3daf0828bcfcee8ff2d9a58444d040829179e052daeafb4ac85e7cfc714cf87e

SHA512
234cc7a35e8c0ef7ee2a72b5c4b98d5492ba65c97f41239f5197cec1678a8f4d86dec1a4266184d10ef8701170eccc9663fba168d3c2ce13cd637ca9b586f5b9

Download Submit
C:\Users\Admin\Downloads\OTPBOT.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 20329.crdownload

Filesize
15.2MB

MD5
7916a13e3e696e94212dc8c2f7509a12

SHA1
a95973839a04ee466db580cf331ac62e60665a39

SHA256
1cf39d304c3cb61703573f93b654fb89fe30627b252053ae91d20e6636e576af

SHA512
642adae82c7ad0c9979d3ab67995a69e20d59ed876251d2a925cead0c1d639ed2876ab3ae3fad6a9f05e8714a15fb6da8f7acbe4fd698288490e33a732449593

Download Submit
memory/916-146-0x00007FF8C90A0000-0x00007FF8C90D4000-memory.dmp

Filesize
208KB

Download
memory/916-147-0x00007FF8C0940000-0x00007FF8C0BF6000-memory.dmp

Filesize
2.7MB

Download
memory/916-148-0x0000015B04810000-0x0000015B058C0000-memory.dmp

Filesize
16.7MB

Download
memory/916-145-0x00007FF781D40000-0x00007FF781E38000-memory.dmp

Filesize
992KB

Download
memory/2000-203-0x00007FF8BCA10000-0x00007FF8BCA27000-memory.dmp

Filesize
92KB

Download
memory/2000-193-0x00007FF8C04F0000-0x00007FF8C0557000-memory.dmp

Filesize
412KB

Download
memory/2000-182-0x00007FF8C06F0000-0x00007FF8C08FB000-memory.dmp

Filesize
2.0MB

Download
memory/2000-184-0x00007FF8C0670000-0x00007FF8C0691000-memory.dmp

Filesize
132KB

Download
memory/2000-181-0x00007FF8C8F20000-0x00007FF8C8F31000-memory.dmp

Filesize
68KB

Download
memory/2000-202-0x00007FF8C0120000-0x00007FF8C0131000-memory.dmp

Filesize
68KB

Download
memory/2000-201-0x00007FF8C0140000-0x00007FF8C015D000-memory.dmp

Filesize
116KB

Download
memory/2000-200-0x00007FF8C0160000-0x00007FF8C0171000-memory.dmp

Filesize
68KB

Download
memory/2000-199-0x00007FF8C0180000-0x00007FF8C0197000-memory.dmp

Filesize
92KB

Download
memory/2000-198-0x00007FF8C01A0000-0x00007FF8C02AE000-memory.dmp

Filesize
1.1MB

Download
memory/2000-197-0x000001E5719D0000-0x000001E571B50000-memory.dmp

Filesize
1.5MB

Download
memory/2000-196-0x00007FF8C0430000-0x00007FF8C0441000-memory.dmp

Filesize
68KB

Download
memory/2000-194-0x00007FF8C0470000-0x00007FF8C04EC000-memory.dmp

Filesize
496KB

Download
memory/2000-179-0x00007FF8D3AD0000-0x00007FF8D3AE8000-memory.dmp

Filesize
96KB

Download
memory/2000-192-0x00007FF8C0560000-0x00007FF8C0590000-memory.dmp

Filesize
192KB

Download
memory/2000-190-0x00007FF8C05B0000-0x00007FF8C05C1000-memory.dmp

Filesize
68KB

Download
memory/2000-189-0x00007FF8C05D0000-0x00007FF8C05EB000-memory.dmp

Filesize
108KB

Download
memory/2000-188-0x00007FF8C05F0000-0x00007FF8C0601000-memory.dmp

Filesize
68KB

Download
memory/2000-187-0x00007FF8C0610000-0x00007FF8C0621000-memory.dmp

Filesize
68KB

Download
memory/2000-186-0x00007FF8C0630000-0x00007FF8C0641000-memory.dmp

Filesize
68KB

Download
memory/2000-183-0x00007FF8C06A0000-0x00007FF8C06E1000-memory.dmp

Filesize
260KB

Download
memory/2000-178-0x00007FF8C0940000-0x00007FF8C0BF6000-memory.dmp

Filesize
2.7MB

Download
memory/2000-195-0x00007FF8C0450000-0x00007FF8C0461000-memory.dmp

Filesize
68KB

Download
memory/2000-191-0x00007FF8C0590000-0x00007FF8C05A8000-memory.dmp

Filesize
96KB

Download
memory/2000-185-0x00007FF8C0650000-0x00007FF8C0668000-memory.dmp

Filesize
96KB

Download
memory/2000-177-0x00007FF8C90A0000-0x00007FF8C90D4000-memory.dmp

Filesize
208KB

Download
memory/2000-176-0x00007FF781D40000-0x00007FF781E38000-memory.dmp

Filesize
992KB

Download
memory/2000-180-0x00007FF8CA210000-0x00007FF8CA227000-memory.dmp

Filesize
92KB

Download