asyncrat | hxxps://drive[.]google[.]com/file/d/1kFWGXbOuoSHe-PRIyX_Rj1njImVOk0HF/view?usp=sharing

Analysis

max time kernel
272s
max time network
279s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
28-08-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1kFWGXbOuoSHe-PRIyX_Rj1njImVOk0HF/view?usp=sharing

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

dcratff.duckdns.org:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2412	01Notificacion.exe
2784	01Notificacion.exe

Loads dropped DLL 12 IoCs

pid	Process
2412	01Notificacion.exe
2412	01Notificacion.exe
2412	01Notificacion.exe
2412	01Notificacion.exe
2412	01Notificacion.exe
2412	01Notificacion.exe
2784	01Notificacion.exe
2784	01Notificacion.exe
2784	01Notificacion.exe
2784	01Notificacion.exe
2784	01Notificacion.exe
2784	01Notificacion.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
1	drive.google.com
5	drive.google.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 912	2412	01Notificacion.exe	112
PID 2784 set thread context of 2476	2784	01Notificacion.exe	116
PID 912 set thread context of 856	912	cmd.exe	118
PID 2476 set thread context of 3768	2476	cmd.exe	119

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01Notificacion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01Notificacion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Notificacion.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1384	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
924	msedge.exe
924	msedge.exe
4780	identity_helper.exe
4780	identity_helper.exe
4260	msedge.exe
4260	msedge.exe
3556	msedge.exe
3556	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2412	01Notificacion.exe
2412	01Notificacion.exe
2412	01Notificacion.exe
912	cmd.exe
912	cmd.exe
912	cmd.exe
912	cmd.exe
2784	01Notificacion.exe
2784	01Notificacion.exe
2784	01Notificacion.exe
2476	cmd.exe
2476	cmd.exe
2476	cmd.exe
2476	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3420	7zG.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2412	01Notificacion.exe
2784	01Notificacion.exe
912	cmd.exe
912	cmd.exe
2476	cmd.exe
2476	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	3420	7zG.exe
Token: 35	3420	7zG.exe
Token: SeSecurityPrivilege	3420	7zG.exe
Token: SeSecurityPrivilege	3420	7zG.exe
Token: SeRestorePrivilege	2408	7zG.exe
Token: 35	2408	7zG.exe
Token: SeSecurityPrivilege	2408	7zG.exe
Token: SeSecurityPrivilege	2408	7zG.exe
Token: SeDebugPrivilege	856	MSBuild.exe
Token: SeBackupPrivilege	1432	svchost.exe
Token: SeRestorePrivilege	1432	svchost.exe
Token: SeSecurityPrivilege	1432	svchost.exe
Token: SeTakeOwnershipPrivilege	1432	svchost.exe
Token: 35	1432	svchost.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
3420	7zG.exe
2408	7zG.exe
924	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1384	POWERPNT.EXE
1384	POWERPNT.EXE
1384	POWERPNT.EXE
1384	POWERPNT.EXE
1384	POWERPNT.EXE
1384	POWERPNT.EXE
1384	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2104	924	msedge.exe	82
PID 924 wrote to memory of 2104	924	msedge.exe	82
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3956	924	msedge.exe	83
PID 924 wrote to memory of 3340	924	msedge.exe	84
PID 924 wrote to memory of 3340	924	msedge.exe	84
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85
PID 924 wrote to memory of 704	924	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1kFWGXbOuoSHe-PRIyX_Rj1njImVOk0HF/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e8613cb8,0x7ff9e8613cc8,0x7ff9e8613cd8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,184772033680893955,8324076130187828785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2120

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap24031:86:7zEvent8000
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3420

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap32012:86:7zEvent5215
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2408

C:\Users\Admin\Downloads\Notificacion\01Notificacion.exe
"C:\Users\Admin\Downloads\Notificacion\01Notificacion.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:856

C:\Users\Admin\Downloads\Notificacion\01Notificacion.exe
"C:\Users\Admin\Downloads\Notificacion\01Notificacion.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2476
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
4646a2bad9067f4b1324efab525e9536

SHA1
e58587517d1de1547fbed29f9c4e88fe0b986962

SHA256
4b2705f8ebecf806cb253d25cd1a3751a3265ba1009e59e62e09cb12c1fcda17

SHA512
4cc1006fdd7914d7ebac55e85a6c94fd22d59fee5c6f3f2d9f55ba987df570e750e607c799220ba1bdfa5fa978c600b1126d5213141de68ba87f6fd05ca2fafa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c3e339f74badbc5c78e4e4401da4244e

SHA1
071025ca2749a66cd03c096095de5953488e1d50

SHA256
7c1f61d1eb2b5efd5d5eb49352b19bd34c2277d95f1273952d3dd6637239a66f

SHA512
3018bc8e6e77b821704a5f260388ed08501b6f4ee18600be3caec8857563687735de94ae6610c30571740733d8dc931a4019193d7e19579a35ee588128388449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3369f7f983650fb56669ef9fda0fa0dd

SHA1
f872c1d04d11e6455d05a21e70a499a2d7d30d45

SHA256
b9b39339e287252c8716396d4cc5ccb7839cafd1121e2d801f4bdb5f0504cb8e

SHA512
6735070df079d4fe2acddd6e71c13428e340117fae5beea644d699622fdd87b3938d20f4798420995147e29c81a6c20cd6ea52d90eadcb23c3835d3e25a18d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
622800abb845ccb5d86a11d8995bd973

SHA1
36238d6c121807168484487b032b61a11ec0fe2c

SHA256
fd810489c27f1eb138b0f1ebb306c66c84dcda72628352ed36786559facccf62

SHA512
2befd6911c2d2c203a5e76052a576f71ea6dea582d5449501e51898a11aed00fb94387a88ab293af659a7e2a528d65afc3980cdbb5bd6780f673ac10af2814d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
44fa24f13b7e270b4255591de300c5a4

SHA1
0e46a42a01f72b3d6e9c36fac02d235ea607bc16

SHA256
dd7a8c4b6ae8e78cbb0e2cc224df759a6f7a4661449806be0069804718ea892c

SHA512
e4f257ee4a0c85aa24191c26e36827bf00b15e64bd91ce14758f72f783b7e09f180ebfca05c1a52ace48da93d94397f589aa98911f689d0c171149c96e9fd74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50b3ffadf8f9c1fec7f112a01952cd43

SHA1
f1e31562fc17c592d4634a1d807ba46c29c9a540

SHA256
3767050605ccc41a95028b295c1d40e4b292a8c9c49536e4caf287cd98f7e2b9

SHA512
58b00f668ee2849856fed0faad54f619a6dbd3534e14190df1eee6869ac86e4e50873a51257b861716f5d6260f86ec65c080c8a71a4ca9115bb3338ded60d3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5560f094c2eb748377a1cbdf9086b7f

SHA1
db1cb65d8655ed54a7e9fb5fb6e8049597a4ec86

SHA256
c41d754be72cd4fb0e7cf7cf023700bc607b7cd506d433ad5bce6b5d7ae5470c

SHA512
c73fb7edbb29c957a09f2b411785fff8b95fb0447492ce2778b1e41e1b93504b1f9830ad244bfc8f69db7ac30d7a02d45283d10b94c03f4c58afdd76a6deb47d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
819281ce0afa4f1caace117bc13d8549

SHA1
2e728745bbbb938d35fdc305620b7b31d6c3e1ad

SHA256
ed4815a2815c301affd74dc642b136987ed4af5c070a8f8f5b124e50c1af67ed

SHA512
f37b9c6501a39b3015328c18c6918836158783a1c61f8e3866517cd801b4de559a0ca84f1548e9a732eac43ea46d6e610397ecb419332dc3a77c9b65931dc443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38cd9696c40984e1be491002a6236ec8

SHA1
a9e23efe6b0338d28430618756ccd2688da548c3

SHA256
4825831a68969edc0d6cc0519657ee13b5605a136855a8921d3a062e9a4d1ce6

SHA512
3dcfd1ec0536ad9cc7731088875a811be82ea9b0a54c269e3622e4f634f3acdc9bc923962af4738b6bff122e392aff52062fc725b815250a8a8843a6f26aa812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d77956ab904648c51bc957ab9d42474

SHA1
3cccdf92703a501e2479b7d544f299803fc4cf05

SHA256
d155be8ac90c0a9b3754983521c8539da8f0ffbe9272537656184b72b7531d9c

SHA512
223ebda8d95920b2c73ae0ad24449dd2480aac74e35b4bb3666e8052b1bdda4da78a5386582d6d2c542b9a71e0a29d1e74438c8446f95dc1efa60eb8bab944e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a08df90

Filesize
761KB

MD5
91dd2e1bce2e2f6da4021b552d45046f

SHA1
1cbc42d4a9aebdef5906b8958d0e719595e23033

SHA256
fcc9a9011b0aab4b792df6cd0fe24a41fccd94602592fb40bbcbf5f52e7ee67e

SHA512
2898a351d60a404482da46b87a1702751f0721c959e4b89ec80c33c1b720d9c6c3058143327b699e95716098eba42606809d45ff864025133ca8e2fb05b03754

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4c24a29

Filesize
761KB

MD5
504ea80621e414d776ff8ffd346c0ca4

SHA1
c57743f834fdaf0965cf33a3d6d2d0f42ec4875d

SHA256
fb2fbb2ff72b73ffae3be1b764751309068f1c7c47007e98ee9443ff8fb0fee4

SHA512
1423e8805bf6a14ae7019b1209fdcd87cb545e83c5586a213ea7b2c4944636b0d1a3a002647794b466bce8e5c6f35d5275b49578bc84a3722aa301ce0f7371df

Download Submit
C:\Users\Admin\AppData\Roaming\DownloadcliRXV\rtl120.bpl

Filesize
1.1MB

MD5
b5792a153b465c509c81e1e27bd31bac

SHA1
7af6e5a44745309d3afab0db068acc110d5fe983

SHA256
557e38c323731fd0ec56ff22a24e72f9cc2022c4189ab434a00935a3af5afaf9

SHA512
c6a457a9818e16cde3fd5832a1c8550ab5195d94a7217cc11d44b4fadd7aa737e1d183d760360e2df779558e511427b3154331105659858fa06e572b60bc0111

Download Submit
C:\Users\Admin\Downloads\Notificacion.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Notificacion\01Notificacion.exe

Filesize
2.3MB

MD5
5d52ef45b6e5bf144307a84c2af1581b

SHA1
414a899ec327d4a9daa53983544245b209f25142

SHA256
26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616

SHA512
458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48

Download Submit
C:\Users\Admin\Downloads\Notificacion\cph

Filesize
577KB

MD5
2fb4b4efc739bcb0e83e119c33f337df

SHA1
fa42c1ba7127c723ee9f827b0bfe29aab3384ebc

SHA256
84e6e89c9543c0e33eef28c55064355045edb8df66ee08198aca5ea70835bc41

SHA512
14396c978d1ebaaf0a060f7b117391104ab74326a4d8029da39b23cb8c7b58c9aa56176c36142d02c1cc811ec665bcc3fcf90a7526f725d515d20f7f7c6f331f

Download Submit
C:\Users\Admin\Downloads\Notificacion\madbasic_.bpl

Filesize
210KB

MD5
e03a0056e75d3a5707ba199bc2ea701f

SHA1
bf40ab316e65eb17a58e70a3f0ca8426f44f5bef

SHA256
7826395127e791a883359ea81308174700da0af8052cc9853b19fd29c2e4badb

SHA512
b0a3cfb6b34832f048fe0fc70c6fa76ae16a2cacda930f6529a83a967d6e8de1c69b93e0de3dc2126c5385d85e814687e695a0a4131399a69633141cad98da2a

Download Submit
C:\Users\Admin\Downloads\Notificacion\maddisAsm_.bpl

Filesize
63KB

MD5
ef3b47b2ea3884914c13c778ff29eb5b

SHA1
dc2b1fa7c7547d8f1ad3f20f9060f7bc686118e0

SHA256
475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87

SHA512
9648d951d8d3640436c8029fd0f06786f7ff8f52191cd6959569c87868bb6c40ac8c7e495c09377a8a5c85e8d3942551c37eb84e916b5c16327d8d43a167820e

Download Submit
C:\Users\Admin\Downloads\Notificacion\madexcept_.bpl

Filesize
419KB

MD5
e33924660e1d9a70913899d9ae7fce07

SHA1
beadd0ed49dfd469c66129c5a4421af0cfd01cc5

SHA256
392b3dfd2ee1f203e30112dafbabb0978754bd63056d9f24cd264c68e2d37b4e

SHA512
2ca8dde963f4b30db54e5b3e91c793cd93be8c3e1ba18b58f073b11789022e912826b6cd058a30171299c0ff2e7fa5b8250626d8fd969d026050006f9ac6a21c

Download Submit
C:\Users\Admin\Downloads\Notificacion\rtl120.bpl

Filesize
1.1MB

MD5
1681f93e11a7ed23612a55bcef7f1023

SHA1
9b378bbdb287ebd7596944bce36b6156caa9ff7d

SHA256
7ed5369fcf0283ea18974c43dbff80e6006b155b76da7c72fa9619eb03f54cef

SHA512
726e8f58648a6abaf1f2d5bebcf28c1d8320551a3b6e7eef0cf8d99f9ef941e30e7004c24c98e9b5e931a86128d26de7decba202390665a005e972dcbe87ab93

Download Submit
C:\Users\Admin\Downloads\Notificacion\tbawy

Filesize
20KB

MD5
b219de9c6185b2d69e7707506b5c8c3e

SHA1
68e3c376696fb7c2c3a9a8686e80b262ceced0df

SHA256
6dac32f38bf106aa9944c5da14289ed87ca357aaa6ce56d95a552e05d5da21ca

SHA512
dd7f88a97742d19652bf34e96c961832cc6c48bf9d2db7b173caf920734e3705864573e9ac9238be2e00e23c79413e07b51e46431a37e3b119487cac0e639543

Download Submit
C:\Users\Admin\Downloads\Notificacion\vcl120.bpl

Filesize
1.9MB

MD5
13a2734bb2249010514386ebc856b8da

SHA1
8f6e3b30f30a5bba9bc6baaf8f440e085a6a568a

SHA256
713c21d009000d504d9bcf3ce95d50e74d3933083783de144db0a16e2425ebcc

SHA512
2f108436fc1a03591802ff6b8c6ac1de1c0388b2a2a6f8839c10b5f0ec06b66775f261da4ace05fa367eb46b5be533949c092e113fe1270adedb9cb8c34ba2dd

Download Submit
C:\Users\Admin\Downloads\Notificacion\vclx120.bpl

Filesize
222KB

MD5
3cb8f7606940c9b51c45ebaeb84af728

SHA1
7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b

SHA256
2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053

SHA512
7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 726707.crdownload

Filesize
3.0MB

MD5
7f4381c31af1a91366c1afc72901e5e6

SHA1
4f66c74ec495f343939d0be5e37bda444f8617ca

SHA256
b7dd15fb9a2cf1a5b4ee161057193c612bc6ae73da7dc7b7f22ca2562ace38a4

SHA512
0437df32920d54ab41849da6f049ad771ccf2e04a0cf2c2b57db2ea4542ee694079062647c4c981dc44106b7f4742763fb6a7c0743cacce51359e20fb3ff789c

Download Submit
memory/856-428-0x0000000005610000-0x0000000005676000-memory.dmp

Filesize
408KB

Download
memory/856-427-0x0000000005BC0000-0x0000000006166000-memory.dmp

Filesize
5.6MB

Download
memory/856-426-0x0000000005570000-0x000000000560C000-memory.dmp

Filesize
624KB

Download
memory/856-425-0x0000000000810000-0x0000000000822000-memory.dmp

Filesize
72KB

Download
memory/856-421-0x0000000072E50000-0x0000000074167000-memory.dmp

Filesize
19.1MB

Download
memory/912-257-0x00007FF9F7860000-0x00007FF9F7A69000-memory.dmp

Filesize
2.0MB

Download
memory/912-295-0x0000000074460000-0x00000000745DD000-memory.dmp

Filesize
1.5MB

Download
memory/1384-437-0x00007FF9B78F0000-0x00007FF9B7900000-memory.dmp

Filesize
64KB

Download
memory/1384-439-0x00007FF9B56D0000-0x00007FF9B56E0000-memory.dmp

Filesize
64KB

Download
memory/1384-440-0x00007FF9B56D0000-0x00007FF9B56E0000-memory.dmp

Filesize
64KB

Download
memory/1384-434-0x00007FF9B78F0000-0x00007FF9B7900000-memory.dmp

Filesize
64KB

Download
memory/1384-438-0x00007FF9B78F0000-0x00007FF9B7900000-memory.dmp

Filesize
64KB

Download
memory/1384-436-0x00007FF9B78F0000-0x00007FF9B7900000-memory.dmp

Filesize
64KB

Download
memory/1384-435-0x00007FF9B78F0000-0x00007FF9B7900000-memory.dmp

Filesize
64KB

Download
memory/2412-254-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/2412-238-0x00007FF9F7860000-0x00007FF9F7A69000-memory.dmp

Filesize
2.0MB

Download
memory/2412-255-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/2412-237-0x0000000074460000-0x00000000745DD000-memory.dmp

Filesize
1.5MB

Download
memory/2412-249-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/2412-250-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/2412-251-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/2412-252-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/2412-253-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/2412-247-0x0000000074460000-0x00000000745DD000-memory.dmp

Filesize
1.5MB

Download
memory/2476-294-0x00007FF9F7860000-0x00007FF9F7A69000-memory.dmp

Filesize
2.0MB

Download
memory/2784-288-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/2784-286-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/2784-287-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/2784-266-0x0000000074460000-0x00000000745DD000-memory.dmp

Filesize
1.5MB

Download
memory/2784-289-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/2784-291-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/2784-292-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/2784-284-0x0000000074460000-0x00000000745DD000-memory.dmp

Filesize
1.5MB

Download
memory/2784-267-0x00007FF9F7860000-0x00007FF9F7A69000-memory.dmp

Filesize
2.0MB

Download
memory/3768-430-0x0000000072E50000-0x0000000074167000-memory.dmp

Filesize
19.1MB

Download