d69299761308057d6288300f98222484af40c1ebc98432bcbcc9c737ac219245

Resubmissions

13-08-2024 08:41

240813-klh2nstfje 10

13-08-2024 08:34

13-08-2024 08:31

13-08-2024 08:22

13-08-2024 08:15

13-08-2024 08:11

13-08-2024 08:07

Analysis

max time kernel
1200s
max time network
1148s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-08-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

free-vpn-3.2-installer_96-miv1.exe
Size

1.7MB
MD5

2798a45b6137fdc262bc01d6c13a2c7d
SHA1

743587eb5afd358591146b8222d2b97d82cb9d1f
SHA256

d69299761308057d6288300f98222484af40c1ebc98432bcbcc9c737ac219245
SHA512

4c8b70261ec5fe915b2c3dcfb6ff644873adcf0d8abb1ba83be30eb600bf1c7fbd6bbd5d0730a610f129e3492517e7cd77e882e9f7b3bfa214e73bfbd361be1b
SSDEEP

24576:W7FUDowAyrTVE3U5F/XkbjztjfSKh7P/1Ks6vk9XpSwR1HNmJrFxgzUsYz:WBuZrEUcztdqAXpSwRWNQ9Y

Score

7^/10

aspackv2 defense_evasion discovery

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000200000002ac27-532.dat	aspack_v212_v242
behavioral1/files/0x000b00000002ac4b-582.dat	aspack_v212_v242

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
91	raw.githubusercontent.com

Executes dropped EXE 15 IoCs

pid	Process
2088	free-vpn-3.2-installer_96-miv1.tmp
2732	YouAreAnIdiot.exe
1644	YouAreAnIdiot.exe
1072	YouAreAnIdiot.exe
1564	YouAreAnIdiot.exe
1548	YouAreAnIdiot.exe
4620	YouAreAnIdiot.exe
4084	YouAreAnIdiot.exe
1376	YouAreAnIdiot.exe
2912	YouAreAnIdiot.exe
1480	Avoid.exe
6024	Launcher.exe
2836	ChilledWindows.exe
1572	Vista.exe
5628	Windows-KB2670838.msu.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Launcher.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Vista.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4012	2732	WerFault.exe	116
1288	1644	WerFault.exe	120
2892	1072	WerFault.exe	123
2820	1564	WerFault.exe	126
1072	4620	WerFault.exe	130
5068	4084	WerFault.exe	131
4580	1376	WerFault.exe	136
4008	2912	WerFault.exe	137
5056	1548	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	free-vpn-3.2-installer_96-miv1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	free-vpn-3.2-installer_96-miv1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vista.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows-KB2670838.msu.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1735401866-3802634615-1355934272-1000\{858EE677-A922-439A-9377-29851C5C957D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1735401866-3802634615-1355934272-1000\{7C142592-3B16-43AF-8EBC-ED9DFD2875A5}	ChilledWindows.exe

NTFS ADS 13 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 779998.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 996264.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Launcher.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 64220.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 306785.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 304557.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Vista.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 38906.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 712059.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1520	msedge.exe
1520	msedge.exe
2072	msedge.exe
2072	msedge.exe
3532	identity_helper.exe
3532	identity_helper.exe
3556	msedge.exe
3556	msedge.exe
4440	msedge.exe
4440	msedge.exe
5404	msedge.exe
5404	msedge.exe
5832	msedge.exe
5832	msedge.exe
5264	msedge.exe
5264	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
2904	msedge.exe
2904	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2836	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2836	ChilledWindows.exe
Token: 33	4592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4592	AUDIODG.EXE
Token: SeShutdownPrivilege	2836	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2836	ChilledWindows.exe
Token: SeShutdownPrivilege	2836	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2836	ChilledWindows.exe
Token: SeDebugPrivilege	5628	Windows-KB2670838.msu.exe
Token: SeDebugPrivilege	5628	Windows-KB2670838.msu.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2088	2644	free-vpn-3.2-installer_96-miv1.exe	81
PID 2644 wrote to memory of 2088	2644	free-vpn-3.2-installer_96-miv1.exe	81
PID 2644 wrote to memory of 2088	2644	free-vpn-3.2-installer_96-miv1.exe	81
PID 1108 wrote to memory of 4916	1108	msedge.exe	86
PID 1108 wrote to memory of 4916	1108	msedge.exe	86
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1516	1108	msedge.exe	89
PID 1108 wrote to memory of 1520	1108	msedge.exe	90
PID 1108 wrote to memory of 1520	1108	msedge.exe	90
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91
PID 1108 wrote to memory of 1136	1108	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\free-vpn-3.2-installer_96-miv1.exe
"C:\Users\Admin\AppData\Local\Temp\free-vpn-3.2-installer_96-miv1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\is-BIPTF.tmp\free-vpn-3.2-installer_96-miv1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BIPTF.tmp\free-vpn-3.2-installer_96-miv1.tmp" /SL5="$6010A,837551,832512,C:\Users\Admin\AppData\Local\Temp\free-vpn-3.2-installer_96-miv1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff7caa3cb8,0x7fff7caa3cc8,0x7fff7caa3cd8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 1232
    3⤵
    - Program crash
    PID:4012
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 1200
    3⤵
    - Program crash
    PID:1288
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 1204
    3⤵
    - Program crash
    PID:2892
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 1208
    3⤵
    - Program crash
    PID:2820
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1256
    3⤵
    - Program crash
    PID:5056
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1120
    3⤵
    - Program crash
    PID:1072
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1120
    3⤵
    - Program crash
    PID:5068
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1128
    3⤵
    - Program crash
    PID:4580
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1120
    3⤵
    - Program crash
    PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5264
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1480
- C:\Users\Admin\Downloads\Launcher.exe
  "C:\Users\Admin\Downloads\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6024
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Users\Admin\Downloads\Vista.exe
  "C:\Users\Admin\Downloads\Vista.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1415427348310722259,77050024398403080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3148 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe
  "C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2732 -ip 2732
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1644 -ip 1644
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1072 -ip 1072
1⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1564 -ip 1564
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4620 -ip 4620
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4084 -ip 4084
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1376 -ip 1376
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2912 -ip 2912
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1548 -ip 1548
1⤵
PID:5068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
1.9MB

MD5
faa6cb3e816adaeaabf2930457c79c33

SHA1
6539de41b48d271bf4237e6eb09b0ee40f9a2140

SHA256
6680317e6eaa04315b47aaadd986262cd485c8a4bd843902f4c779c858a3e31b

SHA512
58859556771203d736ee991b651a6a409de7e3059c2afe81d4545864295c383f75cfbabf3cffaa0c412a6ec27bf939f0893c28152f53512c7885e597db8d2c66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c846780086af4206a42eec5d7ea06612

SHA1
e5229b8c6fba299e2ca2442774bc22db82d4015f

SHA256
adae76096f9cb1cf8d015e7ec86b30756fda99697242638a8ed4b69183b9ba6c

SHA512
2852755d229312469fc883b3801f2c45c320784e68082d2ab0e5eb8643e742eba71e40821cb311a3ab9563b6d77e79b0c7461abe84b75faac0c120722192fc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
879B

MD5
a1aff3c19135978fa7d9b4e82f6f5a6f

SHA1
b4cc72d99eabec5ceb8843053c49f9feb0fd1b43

SHA256
313125c73e25fd1b413890cf2a821a73860e4a4a507cda721c300a046575378c

SHA512
ebbce09272162a005034441575364355ee0356365fd388142df40c921494f28cfc3d62bb89659173084a46a0cae41d2353f50b574020f565e84bfec930fc6fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7577b8e3a1c7e674a8094e389743bc08

SHA1
2838a1c40e4fa5639947eb4f4e993b5e1355ee7e

SHA256
f693730c14fea75af55c0f54852a3a4afc0ad4b77e77476016cd0fdb4ecd9682

SHA512
c0ef6f4868b6bec73d98906dc51e6da3a9076e5365a666dce7f3b2515e3bad4adaf7ef7ad9be07c14eeee06625d4f9b1f7dacb5f348f1e0043fb0f900c2a0ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebddca33bbb9d798db342e385223edd8

SHA1
e467b9dcf6f0fccc671373c09ba99edcfb50c37d

SHA256
6ba761813f7ec31df2f19dc53528a583ab4d9b24d37182a52046b694050f3a3c

SHA512
c82e66868bfe19b9945a8cc11df2bf3f62288dee2f95f3d3c8b9a9183e3eb2850fec8b384d539f0b663499e8e1c9c7601a72cbb7bff71512e8e07b14addf514c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db0ca0e531c6c38a91159ee022932a7f

SHA1
4f0278514c1af449ca789338b582623305a4d3db

SHA256
91be6462919ae1d5d4c1c10c1188873cac66b66fe5f7c5317505d214c798c209

SHA512
1d45b3edc4017aab92a74e835becdd3310ef040bbc4e3aa45ded435366af0719a437e9f162b573707878e26488d37e503b4381f293f150297536781ccf86512e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
746a481e6a201a45524012870db60c4d

SHA1
7b8d9467b66efbbf7ec2141eb668c87b1d0a6aa8

SHA256
962b6df219c13b3fa3acd1393358a85001e1d80abcd50a62124a2b6f30733717

SHA512
b6f31504dc9dff415cdb8526f8ef4ac709e484d3850699e332a8d33f1e9d502091291d3e04390b39bf0cc2427f989d1e3f0e41022bbeea3c9db7f75940bbe4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b8d1aa840d43935d817e5a9d299df14

SHA1
dcb8f595727f49421ca4cdfde296719fe9ce9f9e

SHA256
f3fa43c910e46ae0f0e09c1fa0a839faf60288f0778e1a1a758e58a07cfc34e7

SHA512
2faf3cb59d7dfbb974d026cb836c3f8b1097862d5a5099b3021421aea3d586059cbdccf0a7d3f120a2634d79b90a44426c65596b7bfd7c93d1908825f60e1dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3c0b1f6e0a864e938772680bcd417f7

SHA1
a3a4f3907ad04f64a63ac9a61740373412437b9c

SHA256
1387065e22cdfbe20a8aa1437f8bef906da7747658bb828c94880fcb06bf0149

SHA512
b3139e672a89b1547fb275be173606e5a4018d6d921c991430022c7481121c4f93006d184ad934afa505c43a6b01838ab9d33f7288d1978c5c4e86dc81fbd91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
217c32721c8c6e92cb4c654073e468a5

SHA1
2a1b42c3018e20835028e85f1664cbe2cb199362

SHA256
b4dac7a3b9cc6b611276983008b4f8cd5d884e5fe1b9c2478d370f2777b7361d

SHA512
5fb36539aedc8220aba3715427a97104baf589862e3f4526472422eab8f1a4323debcfa3e4f7ad0258d99f1ff3bd403cf2a1404827f8ce8555aa6bec89958485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6d2d71e7e1eebd75a30242f5dba405c0

SHA1
f0a75c36f8f84be069d29155d46fdf524ec3c6a1

SHA256
936ebef40be57a772af751ad2432e8affc867df1e907f7586733583a6587d0fe

SHA512
f6a9998fed000ce1f0462ece030d89286019b4c9fb55f166c38cccc86625ae7e1ee263a079053067e6e182a2d74d42cdfc405bb912cd27c99d9b728a872f922c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cb71e9b02f555f2ec706c3dcb58b1e09

SHA1
16b0ec08b7ab1728dfcf1296041cd794ea8f8f73

SHA256
63d9b51f0d3778a7a85e62b196c9c4824b0413424fc5cc6c2be14f25a5d1affa

SHA512
b3e9f749b0c278828beab281f52de4e2647f89800b36ea366d5aaaf4375dc5e52008dadb37af4bfb5000820c967f36e469927bb53f126a271d6482e82330b77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8ac65bb03e77e912de6bf5020b8e72b9

SHA1
de9c53e0d32531c288709567a712eae9dbf3f703

SHA256
3fc0f7b42648ec8bb96669a45e56bd82d9c1c27b27fc63bffbab42eeb2ce5d83

SHA512
6b2d6d75c754e66fe719162b6fc312b30c567f0d67802159e51c93a669e1498fe4b5b0c18624a7a0020fc791d946dd8bb5090298d4792a82763e817643dd29d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f811ff07b36639b92c8a5f425859a651

SHA1
9ec51c93a7a97ebf3c09562fd9f230256bd7e6d7

SHA256
5e1fc3615c644159599436915ae50af87fa677abfb26f5fba803d173e97c1c67

SHA512
5a4769b94fd1ba7bc8ab62d219b364d474e24d8ae444e16e1dc2f749322a48cba205485f35c43e43e017eebd8028bc39e1819fd72d773267b94a1c0caf732d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584d6f.TMP

Filesize
1KB

MD5
5aa755521c13dec8832b13c3f2463716

SHA1
9a5e34d9d7c836edd1a9c5e4cc31bb00d8bb5ce1

SHA256
72fb7855cee6dfffed2aa466dd510af395de4427b08f1c5503e0af77ed306eb7

SHA512
819cc1c334f5cc72e5643455ac83e32826041ab0ae4b2708d037f724b53d825e9c5a8a93ccfd0667f19a4d730d83765c3cb20c11d40d3f2cf49eeddaf0a7f5ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6fdf16e2a6dc8f45205bb922f00feb81

SHA1
5611fa2deb98a11035a5bd4e4268180e6db0b31e

SHA256
6eb9e5dbb3599583a8b2c66f833d061665428a8cbbb755c28d6afd040134ad61

SHA512
e968c8d9d7a5bea4c4004df29bc8651576a79039952d67cdd22c72c38003847caeddaa7bd91be9f0bf57db583b2a49c1326b1dec38d2e78e4f12b33ac2aa7167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
077aa13588d7a1d5b317a0fd8e673556

SHA1
9b72755edc679c41a0ac981e235c24b684bf0e9a

SHA256
d8c8a64ce2da1dfc6298c04cab7dd80b5a71ac3defcb098711176ed17dcd419c

SHA512
9437e6e8555d277c8768d69f4e76ff62da41f720795c0c3a4180352bd856e6e84e62e2b8a25ccca4f4e6abf4edbb98c8f6bb7ffc0fa265ed6d7b32e75ed849eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
80a0d3feb088a9adbffff7b90c17a5ce

SHA1
6d1aa4b3a27b6ad971b598845abb5288b2647df3

SHA256
9260104ea54a380d184f4de99fd89cfd915553fe8947d1c459a091374bfa4eb2

SHA512
6e2399388a9486eae6ada8972eef459336aa1c95f87a5f5e2f85106d5ff74eb0f0c80e6e157ff774e196c4cff104deb202c7c0c1f656f25e35a425a4a6b49128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb960035e6c393dac4a1b5bc01c426f3

SHA1
45e479a3f2e108199b851e0f38401ec8f98313d7

SHA256
029e53448562bcd96f6fd9c00f2495351488029e85a040957016f2b8354fbecf

SHA512
ae99d51395a790efd1c0193581d87af3a2816aa74270a1b5e0f0baad41834c38afa257266b6b81297da14f77e9e01c6f9abc495ac7503d6974ec1b4b8379e9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
576KB

MD5
0b8bccd45afc4d39a1af773f57ea8b47

SHA1
824ac4de546437f83bbda99029c336050a3deda5

SHA256
e98970b31bc328351d7dcfaf640b328f401e2f5d3fbc065d82db22aca80590a5

SHA512
193e2a29ea4a3fae66753884dc6917f5c182b3a85a67f2eaa5694cba09955911d388b73c3e4ead2d403b86769069183769473f5c112b0d996d69d890220a14ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BIPTF.tmp\free-vpn-3.2-installer_96-miv1.tmp

Filesize
3.1MB

MD5
db28fcc0fffc6630fe26b980989bcef7

SHA1
5df0b8072c9d6e5eb5f60300ff021774c03fed4b

SHA256
03f35384c001acb1a19371cfc66afd98507b1ad93b4b20cb530679c64b2a8a86

SHA512
e323d28d5e7b8b37a545f52cf7310edfdf6a3c5a3ce0d7e2a2e37ecfc5b72de9c39fb9db177d5420dd16503e4d39a04b59d55f0d84132aa6764349444859ffc4

Download Submit
C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 304557.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 306785.crdownload

Filesize
197KB

MD5
7506eb94c661522aff09a5c96d6f182b

SHA1
329bbdb1f877942d55b53b1d48db56a458eb2310

SHA256
d5b962dfe37671b5134f0b741a662610b568c2b5374010ee92b5b7857d87872c

SHA512
d815a9391ef3d508b89fc221506b95f4c92d586ec38f26aec0f239750f34cf398eed3d818fa439f6aa6ed3b30f555a1903d93eeeec133b80849a4aa6685ec070

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 38906.crdownload

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 712059.crdownload

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 779998.crdownload

Filesize
728KB

MD5
6e49c75f701aa059fa6ed5859650b910

SHA1
ccb7898c509c3a1de96d2010d638f6a719f6f400

SHA256
f91f02fd27ada64f36f6df59a611fef106ff7734833dea825d0612e73bdfb621

SHA512
ccd1b581a29de52d2313a97eb3c3b32b223dba1e7a49c83f7774b374bc2d16b13fba9566de6762883f3b64ed8e80327b454e5d32392af2a032c22653fed0fff8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 996264.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/1480-645-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1572-828-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-834-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-859-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-839-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-832-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-831-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-826-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-824-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-823-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-818-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/1572-807-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/2088-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2088-7-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2644-9-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2644-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2644-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2732-437-0x0000000005820000-0x0000000005876000-memory.dmp

Filesize
344KB

Download
memory/2732-435-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/2732-432-0x00000000009D0000-0x0000000000A42000-memory.dmp

Filesize
456KB

Download
memory/2732-433-0x0000000005540000-0x00000000055DC000-memory.dmp

Filesize
624KB

Download
memory/2732-436-0x00000000054E0000-0x00000000054EA000-memory.dmp

Filesize
40KB

Download
memory/2732-434-0x0000000005B90000-0x0000000006136000-memory.dmp

Filesize
5.6MB

Download
memory/2836-664-0x000000001C860000-0x000000001C86E000-memory.dmp

Filesize
56KB

Download
memory/2836-663-0x0000000021C80000-0x0000000021CB8000-memory.dmp

Filesize
224KB

Download
memory/2836-662-0x000000001B9E0000-0x000000001B9E8000-memory.dmp

Filesize
32KB

Download
memory/2836-650-0x0000000000790000-0x0000000000BF4000-memory.dmp

Filesize
4.4MB

Download
memory/5628-905-0x0000000000A40000-0x0000000000AFC000-memory.dmp

Filesize
752KB

Download
memory/6024-646-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/6024-647-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download