mystic | 248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b

Analysis

max time kernel
606s
max time network
628s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe
Size

1.8MB
MD5

18cbe55c3b28754916f1cbf4dfc95cf9
SHA1

7ccfb7678c34d6a2bedc040da04e2b5201be453b
SHA256

248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b
SHA512

e1d4a7ab164a7e4176a3e4e915480e5c60efe7680d99f0f0bcbd834a4bec1798b951c49ef5c0cca6bea3c2577b475de3c51b2ef1ae70b525d046eb06591f7110
SSDEEP

49152:Eau0Bnly1l8B6hLa5vMIKHVo5W1v2mS0la98MT:Nfy1Wo+JK19eFE6

Score

10^/10

mystic redline smokeloader frant backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

frant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/4188-66-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/4188-69-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/4188-67-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4700-77-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 8 IoCs

pid	Process
4120	Yt8ge85.exe
3972	GY4IC43.exe
4924	hE8Zq97.exe
2408	1Zn59od7.exe
3088	2PO9885.exe
2804	3FD62NB.exe
1916	4Ii975UD.exe
992	5uR3lF9.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Yt8ge85.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	GY4IC43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hE8Zq97.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 3824	2408	1Zn59od7.exe	88
PID 3088 set thread context of 4188	3088	2PO9885.exe	94
PID 2804 set thread context of 3532	2804	3FD62NB.exe	98
PID 1916 set thread context of 4700	1916	4Ii975UD.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1076	2408	WerFault.exe	87
3316	3088	WerFault.exe	92
3644	2804	WerFault.exe	97
1912	1916	WerFault.exe	101

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3824	AppLaunch.exe
3824	AppLaunch.exe
3904	msedge.exe
3904	msedge.exe
1384	msedge.exe
1384	msedge.exe
3960	identity_helper.exe
3960	identity_helper.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4120	2836	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	82
PID 2836 wrote to memory of 4120	2836	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	82
PID 2836 wrote to memory of 4120	2836	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	82
PID 4120 wrote to memory of 3972	4120	Yt8ge85.exe	84
PID 4120 wrote to memory of 3972	4120	Yt8ge85.exe	84
PID 4120 wrote to memory of 3972	4120	Yt8ge85.exe	84
PID 3972 wrote to memory of 4924	3972	GY4IC43.exe	86
PID 3972 wrote to memory of 4924	3972	GY4IC43.exe	86
PID 3972 wrote to memory of 4924	3972	GY4IC43.exe	86
PID 4924 wrote to memory of 2408	4924	hE8Zq97.exe	87
PID 4924 wrote to memory of 2408	4924	hE8Zq97.exe	87
PID 4924 wrote to memory of 2408	4924	hE8Zq97.exe	87
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 2408 wrote to memory of 3824	2408	1Zn59od7.exe	88
PID 4924 wrote to memory of 3088	4924	hE8Zq97.exe	92
PID 4924 wrote to memory of 3088	4924	hE8Zq97.exe	92
PID 4924 wrote to memory of 3088	4924	hE8Zq97.exe	92
PID 3088 wrote to memory of 3964	3088	2PO9885.exe	93
PID 3088 wrote to memory of 3964	3088	2PO9885.exe	93
PID 3088 wrote to memory of 3964	3088	2PO9885.exe	93
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3088 wrote to memory of 4188	3088	2PO9885.exe	94
PID 3972 wrote to memory of 2804	3972	GY4IC43.exe	97
PID 3972 wrote to memory of 2804	3972	GY4IC43.exe	97
PID 3972 wrote to memory of 2804	3972	GY4IC43.exe	97
PID 2804 wrote to memory of 3532	2804	3FD62NB.exe	98
PID 2804 wrote to memory of 3532	2804	3FD62NB.exe	98
PID 2804 wrote to memory of 3532	2804	3FD62NB.exe	98
PID 2804 wrote to memory of 3532	2804	3FD62NB.exe	98
PID 2804 wrote to memory of 3532	2804	3FD62NB.exe	98
PID 2804 wrote to memory of 3532	2804	3FD62NB.exe	98
PID 4120 wrote to memory of 1916	4120	Yt8ge85.exe	101
PID 4120 wrote to memory of 1916	4120	Yt8ge85.exe	101
PID 4120 wrote to memory of 1916	4120	Yt8ge85.exe	101
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 1916 wrote to memory of 4700	1916	4Ii975UD.exe	102
PID 2836 wrote to memory of 992	2836	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	105
PID 2836 wrote to memory of 992	2836	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	105
PID 2836 wrote to memory of 992	2836	248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe	105
PID 992 wrote to memory of 1744	992	5uR3lF9.exe	107
PID 992 wrote to memory of 1744	992	5uR3lF9.exe	107
PID 1744 wrote to memory of 1384	1744	cmd.exe	108
PID 1744 wrote to memory of 1384	1744	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe
"C:\Users\Admin\AppData\Local\Temp\248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 540
        6⤵
        Program crash
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3088
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3964
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 600
        6⤵
        Program crash
        
        PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:3532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 572
        5⤵
        Program crash
        
        PID:3644
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 580
      4⤵
      Program crash
      PID:1912
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D7D2.tmp\D7D3.tmp\D7D4.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ff9990f46f8,0x7ff9990f4708,0x7ff9990f4718
        5⤵
        
        PID:4656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
        5⤵
        
        PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        
        PID:528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:4300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
        5⤵
        
        PID:4308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
        5⤵
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
        5⤵
        
        PID:4380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
        5⤵
        
        PID:2404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
        5⤵
        
        PID:3016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,2023510316535765900,10389671810938636416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff9990f46f8,0x7ff9990f4708,0x7ff9990f4718
        5⤵
        
        PID:3012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6812066489676058828,194834471391418836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
        5⤵
        
        PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2408 -ip 2408
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3088 -ip 3088
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2804 -ip 2804
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1916 -ip 1916
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b598a8e-a69a-4cff-9bb0-858b6448cebc.tmp

Filesize
870B

MD5
193203ae073e45c10bbf3c18a3614173

SHA1
a6155b393b46be7ae4f59206d12935c7fd57b961

SHA256
e0ff2667a2ae414e4c03bf7be313927827c61a92e36c9a8ebb262ed4b6edb583

SHA512
5be3945480043af61fbb3dc54c6237394667ac7fe750acfb0e9158d5d72e68b3fc47892f15c315534556a76cc52eb93ba6ad090472cd8a24dadcd24227ac39dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e9a4421969314b2242b2ce76f1922f9e

SHA1
ec3a3c964c80d4ea96364c3a5f02f35c77bd24b4

SHA256
a42b6b1c0cbd543426c70423117d1e90c052f2efbf0ba9afb7d049e97fcc0af6

SHA512
9d0fce70d3b6482ccc3744f0c93006a318b58031593460472e4f88e4170ffdc3ce7090e601df647a4c2c3b7633187d108558a6ecac3b824111da8b17f032ff98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
20a9ca680e2a8ead39790dc564d489c4

SHA1
dbdc21389ce9a5f2b7b40c4bb4fa2ec739095b04

SHA256
a4623b26c433af917aa099578b915892406b84abd1ed13c07e1b39a2aa8d091e

SHA512
23ed1eb472d61ad1d3ab89ace8e5c0dea6e0b3131574fd6e7dbb545bcc634a2e8b7fba5334efcd62ad01a3e481796f78ff165eaff14eed0b61ed18b53b6f84b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
db9deff73897b6f3b4f0bfa94811e41c

SHA1
08e6d52663959366d99d26f936e6acda49e8b707

SHA256
e0e8a09b9c0ecb4aa4ce482fe38c4f2fed573726eff020ae4c926912a9f26401

SHA512
65a166813b2f197b9aef6c7dd8aeb80917f978773ac877140c257a454f02ee1ca0e15713edad710348b437832339e05aa2331d228a4ac52159b28aca6fd3033a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e0f0b1bcbfe82a8cae9666d1721c3a10

SHA1
bfcbda88e3aa17bde738d71860ae921666ead96c

SHA256
100aeb004f827a248086e9d42c001b16f4ffc6614a3e2ba460257c9595f0fe3c

SHA512
28fe9a7a9201a02262741c50ebf7eaf859b1563104cdcd5418e852fbccbd6d7b411cb7c73f8578c0732c610cb1bd4dc7f1cf8c8518ef88aab9520a138646c94b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dfe0f74cc7ae264a4a06a85c6480bf95

SHA1
6fd4cfd2bc0eabee46e7fceba88314aedd9a2375

SHA256
16b547afb05641b26eefe580fd9b00f095825dee22871727d69ca562d7602cab

SHA512
28bb942b54e76ee8782ef8297be27b7fae4ad27fc43a721376fe40f4f0f03fd94d0d250af08a0bfdf148bab0c7482af88d75645b215b449c00b2fcdbbcf10d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdecde53ed1b396a273715751f60403d

SHA1
4407d95460f24a2f2d46dd2243b280eeb79e2338

SHA256
2b36037715bf769d9ae358d5f19b995dc432b8bdb1cc200160584e22f8ad5ffc

SHA512
c8878aafc11f026e1978f09df7cdd0b234dd4a2adbc94e2544166e314b18cbb0673786abef450650366bcc02bd162663a9197fa0345a664fde5422b228462d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
48414bf97820aa414f54f32e3c0191ec

SHA1
da457f2e1c6c581da625cb86b7c8df1c98746522

SHA256
18c4d71a661cbedd46d21889b701df90d8cc5a31f637699a8a07cc69dd91a2c3

SHA512
64f882112a0b92472dd24ade1af70f06a348feb6b50f130edbf59daa2b32173451d27489a4f414adb8759df7f9a735b95abe587bb1b3c5477550fe211ddad451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
0fadc79d1e22061f4a3b5ac103e4e328

SHA1
90525ed67cb9e46eb69d57175bc9be8e4e427af0

SHA256
874378791c9975d091ccec1746924121a4433f0ae50d3c36a1d466ae4208835d

SHA512
aec93ef9660987bc95236a2568ff9f3c4f4564c5075fb28c55dfb8c89619df8ce93bb99790d717d9317b644fdf7ce2e2ae352feec1e27a1725ecaacd45e46227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588836.TMP

Filesize
872B

MD5
736ca8f982ae3f2842181e0b28f3e164

SHA1
3b03e4dd253155abea239806eb9d15e2403cadfd

SHA256
09312cb24d02528735b858f54f5698b9cf9f398c59f147cc7dfdb729e5e14ff5

SHA512
10ffc5e4f825e98aceb28022de05502591a3f6801f5b697df641e4b1c18f7238602905110c02f29a99cc7971802da00f36ba790238b297aa3e08af6b226dd7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc2a1cbb0d8b4e5cc87341bb63c45039

SHA1
cf11d5344a8f6677355eb7582f91a91543cd4752

SHA256
3b8105bfeba8f9c098c319cbeabe35ea5a12fd336f2956fb830054be44c5f682

SHA512
d7ad40e6aaa4041743138bf966cf8fa831aa1c2de350d58daf23fe226ea3d91ddeb74e44cc8dcb7d627ed4d51582e7e7e6b6f93534981d458391713247f1217e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f2df8c5d0e27c284b48e65bb26566ff1

SHA1
e6bb7a74898464cf6ecaf30c5b3b17904c7311d4

SHA256
f3f916a31b898f3a41747de47499cc6658b69c543efc17c3ffb31a8b73fedcc1

SHA512
bfa2b76a53c452e20529fbcaf38415a04ca32105f53022bc1e045ecbb527d95d0d597026deee1739d04e4d1b62c616d3d07185253947605db431c57a77de58bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp\D7D3.tmp\D7D4.bat

Filesize
90B

MD5
5a115a88ca30a9f57fdbb545490c2043

SHA1
67e90f37fc4c1ada2745052c612818588a5595f4

SHA256
52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d

SHA512
17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe

Filesize
100KB

MD5
e0f8b21b36fee4e7738a6b5a1ab83673

SHA1
e305d55d4d47bfa62eae5f8e6f34e5b133a6f40b

SHA256
c567d825d19e24343647ed36c77033fb1f46f420384745a9734618684cb7d384

SHA512
716e6624ff87c859d08e2bbcda1137a2386d30b5b9ef545daf2c6585bc3366561773b9ad6c719a1ad99f1bacb219544ae4556629b355250e2234a7f87d24e238

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe

Filesize
1.7MB

MD5
847ee3021803e4adaefcc00aa8283017

SHA1
87644df0985b5ef9791c72ce79f423350629659e

SHA256
4611614d9c95b0d0e4bf4aa486cc700db6e49dbef7fa2726b20f165e6798a9f7

SHA512
1aaea476c061160439439d2dadc05e451166faa5614ccf8960b592df6933d07c867ab8813c08026b8b2c35b20b03dc0d26641e228fe06cff8c4938367e515b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe

Filesize
1.8MB

MD5
cfbb3be155b12d0cc69e3d932fbb81eb

SHA1
fb5ed48a80131043c4dd2e4ac69b4b38578f9753

SHA256
fd37c07f519f522eb717a372299525f667439b8b0d1aaffb670a011dbbcd58f2

SHA512
38aadedee5bd57c7f475e96d74abbb0e671bca462c2c700b7a034e2d1513bd8aebc30b7b75bf1e8cd7b7e3a831e69d5dd0ceaee3d18ed296a2cb3d1b051164cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe

Filesize
1.2MB

MD5
252043d1805587b0e65a07f885d6719e

SHA1
2210de44be60ba496ea5d4068e715c1308066989

SHA256
66839bc22b9c9f717198cf8faa64146fe95dff51dfbb8c0f61982f2e50e89557

SHA512
dbcdb0b6fe37cf2c733b6683c2e245008400c84b59450f34a794e513955aaf392982e20f2eb2fce696eec2574fe15f699841748a21fce6a1e20a4381fd52f950

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe

Filesize
1.6MB

MD5
7d377f5e1ba6597ff2cfe4f92639367d

SHA1
188ab803c9926ff3448c458030f418099ea03407

SHA256
c705efd2888dfbede96714b58aede50a28b3da45aba83a909cb104ce34dc735e

SHA512
2adad69f3a358ad955b00c8d7826c396feef9d583407d4c7d53ce3e16ed760f148f553f49df5bbcd6c5c68b87bcf7e1472d3c789946b23dab7ae94b4036540e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe

Filesize
725KB

MD5
403a939a04b4384204d35dbc659bf772

SHA1
a5424bc4b18c00fd261d71861fad75502a963397

SHA256
75d5ae4d95b66cb33ccb1b8c39adda5b287ab6c44b11aa42b8f3351024fce1fc

SHA512
860d17990d95694bd7e799b22e6af6fd93a20276439829e945f9aff079b6c708851e8b3e55200b8ef97d41d91608911a414b4a69c26e5593b9b4ca8a134ddbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe

Filesize
1.8MB

MD5
ca7a5693b5b0e8b54d6dad6a5b1b86b5

SHA1
49da08ec9be5e002b0d22dd630182c3a905c76c7

SHA256
2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

SHA512
68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe

Filesize
1.7MB

MD5
144dc3c0a5275a93ff86f00b5c61b9ec

SHA1
784168ab3c4711737656ca13dc4cb59ca267fa45

SHA256
179649325e561f83a53c5cba99cd8f1f589064c8d0f2029fb8e06f61ae986787

SHA512
9af6a9870077621eb046d6fed0fac88eba35edd4cd5e60f49c46018ab633d5cc77ddb9a93886178544198099a4e3b20726a32729ec9d1cf89524b4a579afb783

Download Submit
memory/3532-73-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3824-54-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-29-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3824-58-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-56-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-36-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-40-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-28-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3824-31-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3824-52-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-35-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-38-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-60-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-32-0x0000000002D80000-0x0000000002D9E000-memory.dmp

Filesize
120KB

Download
memory/3824-33-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/3824-34-0x00000000053A0000-0x00000000053BC000-memory.dmp

Filesize
112KB

Download
memory/3824-62-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-42-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-44-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-46-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-48-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/3824-50-0x00000000053A0000-0x00000000053B6000-memory.dmp

Filesize
88KB

Download
memory/4188-69-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4188-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4188-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4700-79-0x0000000002D40000-0x0000000002D4A000-memory.dmp

Filesize
40KB

Download
memory/4700-89-0x0000000007CF0000-0x0000000007D3C000-memory.dmp

Filesize
304KB

Download
memory/4700-88-0x0000000007CB0000-0x0000000007CEC000-memory.dmp

Filesize
240KB

Download
memory/4700-87-0x0000000007C50000-0x0000000007C62000-memory.dmp

Filesize
72KB

Download
memory/4700-86-0x0000000007D40000-0x0000000007E4A000-memory.dmp

Filesize
1.0MB

Download
memory/4700-85-0x0000000008B80000-0x0000000009198000-memory.dmp

Filesize
6.1MB

Download
memory/4700-78-0x0000000007A00000-0x0000000007A92000-memory.dmp

Filesize
584KB

Download
memory/4700-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download