mystic | 248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b

Resubmissions

14/06/2024, 01:17

240614-bnmm7szalf 10

06/10/2023, 04:38

231006-e9xl3sha6v 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe
Size

1.8MB
MD5

18cbe55c3b28754916f1cbf4dfc95cf9
SHA1

7ccfb7678c34d6a2bedc040da04e2b5201be453b
SHA256

248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b
SHA512

e1d4a7ab164a7e4176a3e4e915480e5c60efe7680d99f0f0bcbd834a4bec1798b951c49ef5c0cca6bea3c2577b475de3c51b2ef1ae70b525d046eb06591f7110
SSDEEP

49152:Eau0Bnly1l8B6hLa5vMIKHVo5W1v2mS0la98MT:Nfy1Wo+JK19eFE6

Score

10^/10

mystic redline smokeloader frant backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

frant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/4424-66-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/4424-69-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/4424-67-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2456-77-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 8 IoCs

pid	Process
4284	Yt8ge85.exe
3832	GY4IC43.exe
2644	hE8Zq97.exe
700	1Zn59od7.exe
1176	2PO9885.exe
4468	3FD62NB.exe
4372	4Ii975UD.exe
4860	5uR3lF9.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Yt8ge85.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	GY4IC43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hE8Zq97.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 700 set thread context of 4908	700	1Zn59od7.exe	93
PID 1176 set thread context of 4424	1176	2PO9885.exe	98
PID 4468 set thread context of 316	4468	3FD62NB.exe	103
PID 4372 set thread context of 2456	4372	4Ii975UD.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
412	700	WerFault.exe	86
1340	1176	WerFault.exe	97
2284	4468	WerFault.exe	101
4492	4372	WerFault.exe	106

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4908	AppLaunch.exe
4908	AppLaunch.exe
3040	msedge.exe
3040	msedge.exe
948	msedge.exe
948	msedge.exe
3664	msedge.exe
3664	msedge.exe
3252	identity_helper.exe
3252	identity_helper.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 4284	2404	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	83
PID 2404 wrote to memory of 4284	2404	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	83
PID 2404 wrote to memory of 4284	2404	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	83
PID 4284 wrote to memory of 3832	4284	Yt8ge85.exe	84
PID 4284 wrote to memory of 3832	4284	Yt8ge85.exe	84
PID 4284 wrote to memory of 3832	4284	Yt8ge85.exe	84
PID 3832 wrote to memory of 2644	3832	GY4IC43.exe	85
PID 3832 wrote to memory of 2644	3832	GY4IC43.exe	85
PID 3832 wrote to memory of 2644	3832	GY4IC43.exe	85
PID 2644 wrote to memory of 700	2644	hE8Zq97.exe	86
PID 2644 wrote to memory of 700	2644	hE8Zq97.exe	86
PID 2644 wrote to memory of 700	2644	hE8Zq97.exe	86
PID 700 wrote to memory of 4508	700	1Zn59od7.exe	89
PID 700 wrote to memory of 4508	700	1Zn59od7.exe	89
PID 700 wrote to memory of 4508	700	1Zn59od7.exe	89
PID 700 wrote to memory of 2908	700	1Zn59od7.exe	91
PID 700 wrote to memory of 2908	700	1Zn59od7.exe	91
PID 700 wrote to memory of 2908	700	1Zn59od7.exe	91
PID 700 wrote to memory of 2420	700	1Zn59od7.exe	92
PID 700 wrote to memory of 2420	700	1Zn59od7.exe	92
PID 700 wrote to memory of 2420	700	1Zn59od7.exe	92
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 700 wrote to memory of 4908	700	1Zn59od7.exe	93
PID 2644 wrote to memory of 1176	2644	hE8Zq97.exe	97
PID 2644 wrote to memory of 1176	2644	hE8Zq97.exe	97
PID 2644 wrote to memory of 1176	2644	hE8Zq97.exe	97
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 1176 wrote to memory of 4424	1176	2PO9885.exe	98
PID 3832 wrote to memory of 4468	3832	GY4IC43.exe	101
PID 3832 wrote to memory of 4468	3832	GY4IC43.exe	101
PID 3832 wrote to memory of 4468	3832	GY4IC43.exe	101
PID 4468 wrote to memory of 2856	4468	3FD62NB.exe	102
PID 4468 wrote to memory of 2856	4468	3FD62NB.exe	102
PID 4468 wrote to memory of 2856	4468	3FD62NB.exe	102
PID 4468 wrote to memory of 316	4468	3FD62NB.exe	103
PID 4468 wrote to memory of 316	4468	3FD62NB.exe	103
PID 4468 wrote to memory of 316	4468	3FD62NB.exe	103
PID 4468 wrote to memory of 316	4468	3FD62NB.exe	103
PID 4468 wrote to memory of 316	4468	3FD62NB.exe	103
PID 4468 wrote to memory of 316	4468	3FD62NB.exe	103
PID 4284 wrote to memory of 4372	4284	Yt8ge85.exe	106
PID 4284 wrote to memory of 4372	4284	Yt8ge85.exe	106
PID 4284 wrote to memory of 4372	4284	Yt8ge85.exe	106
PID 4372 wrote to memory of 2456	4372	4Ii975UD.exe	107
PID 4372 wrote to memory of 2456	4372	4Ii975UD.exe	107
PID 4372 wrote to memory of 2456	4372	4Ii975UD.exe	107
PID 4372 wrote to memory of 2456	4372	4Ii975UD.exe	107
PID 4372 wrote to memory of 2456	4372	4Ii975UD.exe	107
PID 4372 wrote to memory of 2456	4372	4Ii975UD.exe	107

C:\Users\Admin\AppData\Local\Temp\248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe
"C:\Users\Admin\AppData\Local\Temp\248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:700
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4508
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2908
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2420
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 624
        6⤵
        Program crash
        
        PID:412
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1176
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 572
        6⤵
        Program crash
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2856
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 608
        5⤵
        Program crash
        
        PID:2284
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 572
      4⤵
      Program crash
      PID:4492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\47D6.tmp\47D7.tmp\47D8.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe"
    3⤵
    PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffca8cd46f8,0x7ffca8cd4708,0x7ffca8cd4718
        5⤵
        
        PID:1916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,9418767455194095527,5805153007637913377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
        5⤵
        
        PID:2704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,9418767455194095527,5805153007637913377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffca8cd46f8,0x7ffca8cd4708,0x7ffca8cd4718
        5⤵
        
        PID:116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
        5⤵
        
        PID:3440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        5⤵
        
        PID:1616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
        5⤵
        
        PID:3988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
        5⤵
        
        PID:4864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
        5⤵
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
        5⤵
        
        PID:4540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
        5⤵
        
        PID:3488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
        5⤵
        
        PID:3508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
        5⤵
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
        5⤵
        
        PID:1864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
        5⤵
        
        PID:3180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12926903268264573538,14971700167280991743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
        5⤵
        
        PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 700 -ip 700
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1176 -ip 1176
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4468 -ip 4468
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4372 -ip 4372
1⤵
PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac56026f7efda40697e4347d945438f3

SHA1
72dacb24378b7a09f7d1b21f08e505c2ce254250

SHA256
97337e7233753d17067c85e47e0d9c2cac1767324b9724f656b186688bf75d1e

SHA512
4b0c58252128b7864209933d5a93d40ad551a9905e314b0c51f97da68b4ef4ca7ceb0a6b123fa79ed3b4092c254aad6dbd6dce9204d8c1e441c30de596b457fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7085f0267b4499b695d044b56dc855ec

SHA1
e0d549a0f7438b9a7c032a2e165f12bba05e11a8

SHA256
2385c4e417a1c9ce41db76295a8ff30931700fb21dba7151f3a8ce664df97e9b

SHA512
fd77d14c74a8a4ebbed3f3670b972d480137adb57d46eddc85afafadf425cb8f4d61da28f4c4a2da038cae0057db84dc1f3c5779df9aeee85daf82507f0fd26f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c93a70198f170e6faeaf58eebe65633e

SHA1
142dd164660bd206ebaa9cd29c526ab0c00a3d6d

SHA256
166d670db4f4379dd87638281aab885c2a36366122ed7ce68499564580d034c8

SHA512
eec3e5c013959a1f84a33aee9d26d9a9f74c7cd0f93207392d078441926ddd794f67795ce32b31bd9ab9c3941922bcb3d89d1a8f729ae7d7d75f65d8a750e554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6133d22792fb41b9a561e61f4e02b451

SHA1
80eba196ffa2fa6a5dd82e4ab4b64c0c3fbe1851

SHA256
8d32eb76da4e4ad639cb4be49f533d08169ea8dd9bb080bbb47843b48a62aa52

SHA512
850c5e77531ffe3c73c1500d31e3aa04f90ff11c7d894a9263ffc3f8d002b9755c7580919d40e8bb79e8c70966a6d1227f02e13d8c12f24b2856a21bc07d30ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a920f03b451f4793f17c3e60aa68ff11

SHA1
3d8fa38dcee6a25da68ad1780e25b00e50b4f0bf

SHA256
4195476ceb394bc81999b1bb59ec7d7d4c6f4dac6eac94ab6946507beec8ff46

SHA512
19da4e11ffe4f20d4474e914770557e0897d619296f18a414c3c864b0e95f2f98d0a7415ed36e3775e15f62fd37ff67218e0f0a88f1d296c30d521fb83fac94a

Download Submit
C:\Users\Admin\AppData\Local\Temp\47D6.tmp\47D7.tmp\47D8.bat

Filesize
90B

MD5
5a115a88ca30a9f57fdbb545490c2043

SHA1
67e90f37fc4c1ada2745052c612818588a5595f4

SHA256
52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d

SHA512
17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe

Filesize
100KB

MD5
e0f8b21b36fee4e7738a6b5a1ab83673

SHA1
e305d55d4d47bfa62eae5f8e6f34e5b133a6f40b

SHA256
c567d825d19e24343647ed36c77033fb1f46f420384745a9734618684cb7d384

SHA512
716e6624ff87c859d08e2bbcda1137a2386d30b5b9ef545daf2c6585bc3366561773b9ad6c719a1ad99f1bacb219544ae4556629b355250e2234a7f87d24e238

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe

Filesize
1.7MB

MD5
847ee3021803e4adaefcc00aa8283017

SHA1
87644df0985b5ef9791c72ce79f423350629659e

SHA256
4611614d9c95b0d0e4bf4aa486cc700db6e49dbef7fa2726b20f165e6798a9f7

SHA512
1aaea476c061160439439d2dadc05e451166faa5614ccf8960b592df6933d07c867ab8813c08026b8b2c35b20b03dc0d26641e228fe06cff8c4938367e515b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe

Filesize
1.8MB

MD5
cfbb3be155b12d0cc69e3d932fbb81eb

SHA1
fb5ed48a80131043c4dd2e4ac69b4b38578f9753

SHA256
fd37c07f519f522eb717a372299525f667439b8b0d1aaffb670a011dbbcd58f2

SHA512
38aadedee5bd57c7f475e96d74abbb0e671bca462c2c700b7a034e2d1513bd8aebc30b7b75bf1e8cd7b7e3a831e69d5dd0ceaee3d18ed296a2cb3d1b051164cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe

Filesize
1.2MB

MD5
252043d1805587b0e65a07f885d6719e

SHA1
2210de44be60ba496ea5d4068e715c1308066989

SHA256
66839bc22b9c9f717198cf8faa64146fe95dff51dfbb8c0f61982f2e50e89557

SHA512
dbcdb0b6fe37cf2c733b6683c2e245008400c84b59450f34a794e513955aaf392982e20f2eb2fce696eec2574fe15f699841748a21fce6a1e20a4381fd52f950

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe

Filesize
1.6MB

MD5
7d377f5e1ba6597ff2cfe4f92639367d

SHA1
188ab803c9926ff3448c458030f418099ea03407

SHA256
c705efd2888dfbede96714b58aede50a28b3da45aba83a909cb104ce34dc735e

SHA512
2adad69f3a358ad955b00c8d7826c396feef9d583407d4c7d53ce3e16ed760f148f553f49df5bbcd6c5c68b87bcf7e1472d3c789946b23dab7ae94b4036540e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe

Filesize
725KB

MD5
403a939a04b4384204d35dbc659bf772

SHA1
a5424bc4b18c00fd261d71861fad75502a963397

SHA256
75d5ae4d95b66cb33ccb1b8c39adda5b287ab6c44b11aa42b8f3351024fce1fc

SHA512
860d17990d95694bd7e799b22e6af6fd93a20276439829e945f9aff079b6c708851e8b3e55200b8ef97d41d91608911a414b4a69c26e5593b9b4ca8a134ddbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe

Filesize
1.8MB

MD5
ca7a5693b5b0e8b54d6dad6a5b1b86b5

SHA1
49da08ec9be5e002b0d22dd630182c3a905c76c7

SHA256
2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

SHA512
68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe

Filesize
1.7MB

MD5
144dc3c0a5275a93ff86f00b5c61b9ec

SHA1
784168ab3c4711737656ca13dc4cb59ca267fa45

SHA256
179649325e561f83a53c5cba99cd8f1f589064c8d0f2029fb8e06f61ae986787

SHA512
9af6a9870077621eb046d6fed0fac88eba35edd4cd5e60f49c46018ab633d5cc77ddb9a93886178544198099a4e3b20726a32729ec9d1cf89524b4a579afb783

Download Submit
memory/316-73-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2456-89-0x0000000007B30000-0x0000000007B7C000-memory.dmp

Filesize
304KB

Download
memory/2456-85-0x0000000008810000-0x0000000008E28000-memory.dmp

Filesize
6.1MB

Download
memory/2456-79-0x0000000004BA0000-0x0000000004BAA000-memory.dmp

Filesize
40KB

Download
memory/2456-78-0x0000000007770000-0x0000000007802000-memory.dmp

Filesize
584KB

Download
memory/2456-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2456-86-0x0000000007A20000-0x0000000007B2A000-memory.dmp

Filesize
1.0MB

Download
memory/2456-87-0x0000000007950000-0x0000000007962000-memory.dmp

Filesize
72KB

Download
memory/2456-88-0x00000000079B0000-0x00000000079EC000-memory.dmp

Filesize
240KB

Download
memory/4424-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4424-69-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4424-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4908-61-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-48-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-35-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-36-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-38-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-40-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-42-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-44-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-46-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-50-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-52-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-54-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-56-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-62-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-58-0x0000000005750000-0x0000000005766000-memory.dmp

Filesize
88KB

Download
memory/4908-34-0x0000000005750000-0x000000000576C000-memory.dmp

Filesize
112KB

Download
memory/4908-33-0x0000000005CA0000-0x0000000006244000-memory.dmp

Filesize
5.6MB

Download
memory/4908-32-0x00000000056B0000-0x00000000056CE000-memory.dmp

Filesize
120KB

Download
memory/4908-29-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4908-31-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4908-28-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download