2285bebaf8083d4b1158643b71d802ead2f12fc9f6d2325bc92b1680cf07458e

Analysis

max time kernel
571s
max time network
456s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WeMod-Setup.exe
Size

141KB
MD5

7540be950fd3e93baaf7e2f96a1514b8
SHA1

e2d956f8b8dc86d9bb68156d048e6ca84d5b6dd2
SHA256

2285bebaf8083d4b1158643b71d802ead2f12fc9f6d2325bc92b1680cf07458e
SHA512

356a24c3e5f43b2de356ccd5538d9e603eeb8d44c1965c0b538287a61db5b137a2ea89d394e01816bc6aac33b6d494b6881a29e31381ae14eba27b0c5b0a8a32
SSDEEP

3072:XGjm4ILlCI+4COHCyhaEtHZugr7t4ILlCI+4TOHHSTs:Xr+bwaEtHBHto

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

mspaint.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1162180587-977231257-2194346871-1000\{00C5A84F-6352-49C6-A40C-22596BD7D08E}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

1320 vlc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

mspaint.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
464	mspaint.exe
464	mspaint.exe
4072	msedge.exe
4072	msedge.exe
2248	msedge.exe
2248	msedge.exe
2848	identity_helper.exe
2848	identity_helper.exe
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

1320 vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

Processes:

msedge.exe

pid	process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 5408 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 5408 AUDIODG.EXE

description	pid	process
Token: 33	5408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5408	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

vlc.exemsedge.exe

pid	process
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of SendNotifyMessage 45 IoCs

Processes:

vlc.exemsedge.exe

pid	process
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
1320	vlc.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

WeMod-Setup.exeWeMod-Setup.exeWeMod-Setup.exeWeMod-Setup.exeWeMod-Setup.exemspaint.exeOpenWith.exevlc.exe

pid	process
3216	WeMod-Setup.exe
3216	WeMod-Setup.exe
4616	WeMod-Setup.exe
4616	WeMod-Setup.exe
4524	WeMod-Setup.exe
4524	WeMod-Setup.exe
4796	WeMod-Setup.exe
4796	WeMod-Setup.exe
4184	WeMod-Setup.exe
4184	WeMod-Setup.exe
464	mspaint.exe
3788	OpenWith.exe
1320	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2248 wrote to memory of 4152	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 4152	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1600	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 4072	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 4072	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 1352	2248	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4616

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4796

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4184

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UseGrant.jpe" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnregisterAssert.wav"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc4fae46f8,0x7ffc4fae4708,0x7ffc4fae4718
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14204826204536763433,11037988601369468735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
f1b1fdaefdab9869cc931e45723c799a

SHA1
e6c5100e1c11412cb4181de9ba00e00a22813811

SHA256
5dbd9d012c4aa51f201a13eade1c37074559a269784bb227d1f83d3fc9a27e50

SHA512
a210244efc4d025470878fe7e4673c084794ce2a98850033f9ef4bf2840a807634bf44a391306a68f85a6d5b6aa309c2d5a23f833527cc7350f057ead235d83b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
73a577928b5afb1081ef43be593fe435

SHA1
5e7f98a27c32e924b9001d7a3cfcbf77ad5e7f45

SHA256
7f2eaf0cf4114b188c98acb869921ba85fcbed16193ae70cc682c26159a72790

SHA512
609f087da05062d3fb91bdb130b9e367f3a19e9f09372c0fc3a419f461df2fa05483d8c3b71591f34df25c0d5a32a20dc944544e1d5babe47356745bb2ea49d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0485e8dc05c737f6c6d54dae719f2c29

SHA1
3a2d666cc1609bc545f7bfbe09d4f859f15e6567

SHA256
b758b0bebac0106f8db5b35ccc2160d43d326ddb808d33cb8a1d07e859cc540f

SHA512
73e0d4d5448c7e1965e22831f236d6293fc3e166170052ae1f89572a2496e5e2a03f1048f36f853c047c52f758d5e07b9ce05a2fc688b97d80b2f6da110874b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
693f12954e3cbc7aca83383292808185

SHA1
0e865e017dba2bd9542fe741d513891d1963462e

SHA256
f9489a8b9a6e3512354b56041c451ff363917b04491ecb047d98c096f067525e

SHA512
b58232b7e3946f525b3f300920f54c140d758ca8c601e79e1c1ac0b033b51a212f28c84185180e241d2f5737e71da332faf934866ded4b4ee3561ec05dfc9451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97dda6579fcd192c29e07cc36d4a619a

SHA1
a0ffba13a65aae3626d6c30da4fb85ea7b5e6957

SHA256
625d414c97a45b47501175691dea8da25c0a58a64bfe1da40409c91adaeb6e35

SHA512
394ca2fcead10b04b36b176d6423e6705e1509172f410ee00409a0004f589b1b3c78bb85ff9e4fdc4187d6c9cf9d3580ebde00ef9f371a31b52806198871944c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
92e984c78a7caf4f7b3479f8136dc7ba

SHA1
46cec669d26fa4c0a661c8cbde4da25e82e7e4c6

SHA256
664bc0bb5af7ceb1158be7c13a606f117d56a1c03d9260468a2348068355273e

SHA512
6ab977dd71cc0cc4b8c42720c72143bb59341d1c4461bf3810602f4865477c128d39338f071a7b1f2da3bbf54c4c7c5c0c429930c2de17a97711922acbd01371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2dd541458af0646b62940ec1e9738a8

SHA1
41f44bec1cffc532c2bd5364542eb775448d687e

SHA256
255b654f4e912d25abeea766e6e8f1bc77425692b5b167d60d82a2d39d9d80f6

SHA512
93fe927402196db28ae64eb3cc0eca6d06c97cb4414a132e9cc9b4cf1e1c5e1f08d9c64bd671e56a67fe33af0cc4bbd200e24cb4a1f39380d61ef03a391c1e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f01f7dbc0ca7e5feb7bc9e8bce38734e

SHA1
b76bd9603c98ac28f5c338553f22af25e0fcba85

SHA256
edb09a3426ad7cf2a85340b62a83adbd86f03fcf8fbb1d2cf30f02d045f7586f

SHA512
1b3be71e32fb95fe41e869972af9e817bc55927f2a72f427f58f0169e1d7c3d5badcd17d4ec630168514ef4bbf9857ab0124a0f707aa43d01eab0ae6f849146f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6820a70f60c0eaec030fedaf051b7cbe

SHA1
2e17bd58b71ba53e09d543a9427da83134d40b96

SHA256
df8663a586f8b1ed0c98d49b4d074698d98c2d3e381af75ba1aa4b0528027972

SHA512
64542f13fa408b193c24d472a9385a0157ff5d7e639a87ae51bbdc72d340c86ce0dc280cb35e992679f22635bce53210d42f407bac8fd5c297c03c6fcd5be408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
e4f324f0ee33a886e9f1ca14378fd05e

SHA1
56d4f4afe93ea659a7124474942eb9bb921b9a24

SHA256
6f12292a249ca39aca706680e6f617089530c39e23df252388a568edf8b0800d

SHA512
fd5f7555ef056024174dbd492c6e2f759cd48688946708ca55923445bccecd7acf6ec8da9804826f990b9e88f8f028682534834e23622929e098b740554fb3b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a618a.TMP

Filesize
48B

MD5
dc8c9ae3fa8617eb3023aff1e6c1942c

SHA1
88cbd2c2bb8fa30ece6db1ac729e967cdeb6fbb6

SHA256
39c1186ebc33918116f82d34b2df0ef96ed415bce0aa3a430ab15db32d376f0d

SHA512
867ab07d9f5578b74bedf0e824feaaeac7b7d059ab00f3df34e642d5c8027973c78c1b88f760272198142f1e1078e20fd992af2eca33bd8c4ef98d6761410401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a63b12bb0cd201fdd6cbd3050e2ba16a

SHA1
446ef7cea6dd154c8781d437b23ff1d643a0e0fa

SHA256
151f8382245174b37d2718e0134231b6fc7fe3b6594e4c662a7584447c648eef

SHA512
bcae77096e118d74efecbcdca7f5645d4b7743ecafc26528372e1c5f6d6c33f3fdd5ce3e98f5351afb6aa84708bf1f75ea5b42a44ffaf384633cb5765dfe0741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
40d8d5267439d4aa54f8d5362d16a729

SHA1
d72669fdc85d6d3b7263cd4e38e9f1938bab6833

SHA256
ca81aa29a792e71369db9a372cff05e25b11f346ac249102f75697367da7a814

SHA512
a75c7ad7c4cf9001025bb0163e43490f141bda9d120605e2cea2b5ec009b19bbe9bce9a6233af9e3769f1dc8c7a67d82adca105883119e324cb6203dd7367beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a67a4.TMP

Filesize
1KB

MD5
01118b10bafc02c0201b3f2042273e32

SHA1
453b04f5ffd98b91eeadfd9de4711d7634013048

SHA256
ac3e902d71b1a460300c0a44392601f501d56709152f77a0703614843c69c37d

SHA512
7697395615eb453f9bc270cd73f98c55b7c909397528c15f1f5e9e747153235bfa0d8b5f6c78804bcb9bc2ba513fa5a2c021cb0aeec13143cabaeeb5051509f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ff45ca4c5c753e16af2047dde04dc511

SHA1
f6ecafec0b46b905ee281a027e39c55174edddeb

SHA256
084fcd1e70b012791fb8f54bf2202e58a710ebddd79d113a6870b7414d1e9959

SHA512
808a1230584b7616b01986a07289dc1be1c06b6e60c5b815136f9755b61afd5c4b280baa570772cf813d1733aa74908250b8b3819717bfe660908520e13ba6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9ae2aa692290430012d58ee571f9f09

SHA1
eea8feef80f56519d58395f2e3b13af01fd15eb5

SHA256
03c6fe3945751250c37b3b5dae14d5075ff5bd682aee7e4ebb4d656ee171bdd6

SHA512
165d4f68ad1b91573dc0407e6c0c4eb5557a4bd4c2ee09d33030ae06c37372c532dc9b353b7b601be0f3eb274064737cfe9e3d80ce052ffb59a51c1cbbe4e692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9O7X9C7J\setup[1].htm

Filesize
24KB

MD5
32526c5e58a1c4a2abc5b46de8fab6ed

SHA1
aa874a2e1be48b3e92f92cc2ebc6b0071c02f47f

SHA256
1f3e10b11c9045dfa88b9002fe24888fc5df8337b90a31569d87893281c7855d

SHA512
76ac72e32df9dc3a5aa66c002e1abbb0137aa716e94d5e2cf6a93dd0e8906609ef433537a78c72839288e9e52e505d4e826abb58f50dba3425f2e057e84d16d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I3C6LG3F\setup[1].htm

Filesize
26KB

MD5
6d2ecaa1c6002853ec10169e4a0b1325

SHA1
47084a2776a4e6a47db590c1c6831a3042e7893d

SHA256
a09bb0acac44313aaeff407f805e8f7fbfb1c9e2438ef04e511219a631284280

SHA512
1fb25a768389509ef2151ad00172d95d0ac39c8d5f13be8d30b53af82c0248889f140b66963d96d9f305dd4ad2186d397dd5116dd1f80b751dccb3655b340c81

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
82B

MD5
b940860dea4b8dbe1718e17e52f6e68a

SHA1
3aef3f9758ea29a290013e96ddd3dbdcbdd6e268

SHA256
cdc0e9005131359ee5cd25887599148b57af16c51b4c5beef2d04523f1099304

SHA512
e76119a1f7dc7bf0ab50743295934736c06ac9f39007e672776952f218b19c23bc3c0d203fe01cd9caec1cff7249f706b92224e6f1d873660dfc444ded2dc65c

Download Submit
\??\pipe\LOCAL\crashpad_2248_BLGXZEPFVMCIJXQK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1320-78-0x00007FFC509E0000-0x00007FFC50A14000-memory.dmp

Filesize
208KB

Download
memory/1320-77-0x00007FF740AE0000-0x00007FF740BD8000-memory.dmp

Filesize
992KB

Download
memory/1320-80-0x00007FFC3E450000-0x00007FFC3F500000-memory.dmp

Filesize
16.7MB

Download
memory/1320-79-0x00007FFC41160000-0x00007FFC41416000-memory.dmp

Filesize
2.7MB

Download
memory/3216-0-0x0000022F055F0000-0x0000022F05616000-memory.dmp

Filesize
152KB

Download
memory/3216-1-0x00007FFC40BD3000-0x00007FFC40BD5000-memory.dmp

Filesize
8KB

Download
memory/3216-2-0x00007FFC40BD0000-0x00007FFC41691000-memory.dmp

Filesize
10.8MB

Download
memory/3216-3-0x00007FFC40BD0000-0x00007FFC41691000-memory.dmp

Filesize
10.8MB

Download
memory/3216-4-0x00007FFC40BD0000-0x00007FFC41691000-memory.dmp

Filesize
10.8MB

Download
memory/3216-5-0x00007FFC40BD0000-0x00007FFC41691000-memory.dmp

Filesize
10.8MB

Download
memory/3216-12-0x0000022F1FC10000-0x0000022F20367000-memory.dmp

Filesize
7.3MB

Download
memory/3216-13-0x00007FFC40BD0000-0x00007FFC41691000-memory.dmp

Filesize
10.8MB

Download
memory/3868-46-0x000001C0127A0000-0x000001C0127A1000-memory.dmp

Filesize
4KB

Download
memory/3868-27-0x000001C00A360000-0x000001C00A370000-memory.dmp

Filesize
64KB

Download
memory/3868-31-0x000001C00A3A0000-0x000001C00A3B0000-memory.dmp

Filesize
64KB

Download
memory/3868-38-0x000001C012680000-0x000001C012681000-memory.dmp

Filesize
4KB

Download
memory/3868-40-0x000001C012700000-0x000001C012701000-memory.dmp

Filesize
4KB

Download
memory/3868-42-0x000001C012700000-0x000001C012701000-memory.dmp

Filesize
4KB

Download
memory/3868-43-0x000001C012790000-0x000001C012791000-memory.dmp

Filesize
4KB

Download
memory/3868-44-0x000001C012790000-0x000001C012791000-memory.dmp

Filesize
4KB

Download
memory/3868-45-0x000001C0127A0000-0x000001C0127A1000-memory.dmp

Filesize
4KB

Download