hxxps://g3niusn2[.]ir/loader[.]exe

Analysis

max time kernel
76s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://g3niusn2.ir/loader.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
2164	loader.exe
3864	loader.exe
5140	loader.exe
5256	loader.exe
5704	loader.exe
5772	loader.exe
5880	loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

pid	Process
2164	loader.exe
2164	loader.exe
3864	loader.exe
3864	loader.exe
5140	loader.exe
5140	loader.exe
5256	loader.exe
5256	loader.exe
5704	loader.exe
5704	loader.exe
5772	loader.exe
5772	loader.exe
5880	loader.exe
5880	loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 7 IoCs

pid	pid_target	Process	procid_target
5652	5140	WerFault.exe	119
5676	3864	WerFault.exe	117
5668	2164	WerFault.exe	115
5848	5256	WerFault.exe	121
6088	5704	WerFault.exe	130
5168	5772	WerFault.exe	139
3800	5880	WerFault.exe	142

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 87214.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
1064	msedge.exe
1064	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
2940	msedge.exe
2940	msedge.exe
2164	loader.exe
2164	loader.exe
3864	loader.exe
3864	loader.exe
5140	loader.exe
5140	loader.exe
5256	loader.exe
5256	loader.exe
5704	loader.exe
5704	loader.exe
5772	loader.exe
5772	loader.exe
5880	loader.exe
5880	loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2164	loader.exe
3864	loader.exe
5140	loader.exe
5256	loader.exe
5704	loader.exe
5772	loader.exe
5880	loader.exe
3848	AcroRd32.exe
3848	AcroRd32.exe
3848	AcroRd32.exe
3848	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2472	1064	msedge.exe	84
PID 1064 wrote to memory of 2472	1064	msedge.exe	84
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3004	1064	msedge.exe	86
PID 1064 wrote to memory of 3688	1064	msedge.exe	87
PID 1064 wrote to memory of 3688	1064	msedge.exe	87
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88
PID 1064 wrote to memory of 4684	1064	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://g3niusn2.ir/loader.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff849ee46f8,0x7ff849ee4708,0x7ff849ee4718
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,1972147514292250533,11437787742706932571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 732
    3⤵
    - Program crash
    PID:5668
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 728
    3⤵
    - Program crash
    PID:5676
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 728
    3⤵
    - Program crash
    PID:5652
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 728
    3⤵
    - Program crash
    PID:5848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5140 -ip 5140
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3864 -ip 3864
1⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2164 -ip 2164
1⤵
PID:5612

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 728
  2⤵
  - Program crash
  PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5256 -ip 5256
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5704 -ip 5704
1⤵
PID:6064

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 824
  2⤵
  - Program crash
  PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5772 -ip 5772
1⤵
PID:5832

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 824
  2⤵
  - Program crash
  PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5880 -ip 5880
1⤵
PID:1944

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3848
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=69DB884C87A07457ED891E89CBB322A6 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:264
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=16771972422ADC74895C3B8F7FBDF711 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=16771972422ADC74895C3B8F7FBDF711 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1380
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3D11E88FFC72263091019377F413EF0C --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3283456FCAC4E8BF3832B3C2E30A06EB --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=39FDB867A6C6B9B1C28D18AE83B94570 --mojo-platform-channel-handle=2376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=197971D9458C32FA7169BD1783B722FD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=197971D9458C32FA7169BD1783B722FD --renderer-client-id=7 --mojo-platform-channel-handle=2524 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
4b406bc9af2a84fd5252604557b2f2b9

SHA1
f9c834a57d29bd521a223fc4c72a7825e6246b0b

SHA256
49f14faf56add046df8b517e5bd8fa52cf90690461198f033ab17d6bf1dbd834

SHA512
21522c0ee21fa3f5813286e94908ca9d91d4ce41265ca6f0a44da36a3f238fbcb045bc3679f66d9840e401a983e3adc4255a9a198e91d2baea65b64ce930e8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
74fceb35ce7ff7c87ccfe1279d54ad23

SHA1
04bb58a265d5a305e775b55b643e932c599c524a

SHA256
a95ca38ad8c20c262e34a27aa74baca375787bb9de56ea97221f1e19b1d6e783

SHA512
c80c0871919328cc829762b8c4735cb57330008eda781ed648d2a081b736918a585dafb0105c16c5f405d6975cf9d7c2aefd7dc5eebad413812263cd133c018f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d094d876b8b1d9c1a3f1927ab915208a

SHA1
cc0b0437e0b999400d91a509bf7906b0090a1014

SHA256
6f97b6acc971bb1b3b77a82372c51755f715b890bb4f28359d0c44cff859e0e9

SHA512
a50dab5de5e4af839e7ba786b2956644a2b00975ce8f27fa7555f9d234a18024fbe5a875f65f10585587eab00db3de3764a27b0bca0b00cabc62872f2a169b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a28fb4f40078fad3fcf57c3e9e029e9e

SHA1
4bd1743c537fae26119b91b0daaa09a3f9260176

SHA256
7e173a89220c3d08704d8f8930310cde36ac9ac36c0b67c6e929a671592da979

SHA512
dc52af06d8f08e1beaa5d283c0a1f7b8de342e548aa75ab2e486534c8672fc142f2384b023236bfd990d17d8c5eb1805e04da95fcae53f502a6c5708846a683b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05e71fb813dfb78526bc4f4e3d6d238a

SHA1
10f72954a1573edfc3f0571d4b1bd91927675072

SHA256
60f66fda65a8113842e32da40df5de41830e8f281de490eb81cddc90d8fed617

SHA512
b6aea6f580391670b901a04cece3bcf0e76181d9c27feb679d4a9235b484db27b37e87d01a2b7f297defd354fad1fa771546980ef8380edb94438cd856020955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2c4053ede29075bdd97164fa2d590bd9

SHA1
b342601c79ea1c11a85544e72e860e8586d61299

SHA256
ec15e2f8df53c3be1312d84f6e2f4e70e707f3214ad8affc222be35a03d7ddf7

SHA512
f711729a59f6dc684c8d3502ba75b3465d775ccdf2f5de36287c4b0357bf6edc86adaefa0cf91cb39a86dd291b26c83c2716b303d76217a1d005b5327f58dd0f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 87214.crdownload

Filesize
23.1MB

MD5
9fce3156c0b50805a6b8ecf7eca0aebd

SHA1
32f0f8b3e369c37b134de8bdb8df54496306d280

SHA256
7f19efb07b3776c1e843c065b0c91068324da77da4c42d9336d7e25d07b00107

SHA512
66bc488ceae9a3199fb0dff9b0bf10eea57e2d9beff95e341ab82a60aefa524f7ef5b289d5cebaa48b31ada82bba375583cbba8b572f46ac8a9b5a1f9feea4f8

Download Submit
memory/2164-82-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/2164-81-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/2164-80-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/2164-79-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/2164-77-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/2164-78-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/2164-83-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/2164-84-0x0000000000400000-0x0000000003353000-memory.dmp

Filesize
47.3MB

Download
memory/3864-89-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/3864-88-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/3864-91-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/3864-92-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/3864-93-0x0000000000400000-0x0000000003353000-memory.dmp

Filesize
47.3MB

Download
memory/3864-86-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/3864-90-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3864-87-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/5140-95-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/5140-100-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/5140-99-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/5140-102-0x0000000000400000-0x0000000003353000-memory.dmp

Filesize
47.3MB

Download
memory/5140-98-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/5140-96-0x00000000035F0000-0x00000000035F1000-memory.dmp

Filesize
4KB

Download
memory/5140-97-0x0000000003600000-0x0000000003601000-memory.dmp

Filesize
4KB

Download
memory/5140-101-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/5256-110-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/5256-112-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/5256-115-0x0000000000400000-0x0000000003353000-memory.dmp

Filesize
47.3MB

Download
memory/5256-109-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/5256-108-0x00000000034C0000-0x00000000034C1000-memory.dmp

Filesize
4KB

Download
memory/5256-113-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5256-111-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/5256-114-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/5704-143-0x0000000000400000-0x0000000003353000-memory.dmp

Filesize
47.3MB

Download
memory/5704-139-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/5704-138-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/5704-137-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/5772-150-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/5772-151-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/5772-154-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/5772-153-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5772-152-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/5772-155-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/5772-158-0x0000000000400000-0x0000000003353000-memory.dmp

Filesize
47.3MB

Download
memory/5880-172-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download