1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8

Resubmissions

02/09/2024, 19:47

240902-yhtwnawbqm 8

02/09/2024, 19:44

02/09/2024, 16:42

02/09/2024, 04:27

02/09/2024, 04:25

02/09/2024, 04:23

02/09/2024, 04:20

24/08/2024, 02:54

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sticking-out-your-gyatt-for-the-rizzler.mp3
Size

175KB
MD5

27b535b4401ff51e152ef5f6fdaa2b5c
SHA1

eec3bba56eae9ff73d527c3638f3515d1c60da9b
SHA256

1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8
SHA512

9e322aef6c0c41f16fd0e101b89766032240570addba1a3be77b48207bc60c50a9ec3fbe82da9925d8d878ef111b625e629c05ee3dc23e30df10f8c523c8515e
SSDEEP

3072:nU/Sk+yOMHjhLbJdTJ/ffFFxEuy1hqFXNQlPgoTzS+GpQE4pCUW4hkFTMRsHeV8L:nUK1yTdLbJrXPxEuy1jFJkpaxBV6

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4332	392	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{9CAF9A24-7FF1-4B9B-A91F-C3787C73EF0C}	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{E860AB6C-1D5F-4927-8C42-2290677CE060}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
4052	msedge.exe
4052	msedge.exe
4620	identity_helper.exe
4620	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
6056	msedge.exe
6056	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	392	wmplayer.exe
Token: SeCreatePagefilePrivilege	392	wmplayer.exe
Token: SeShutdownPrivilege	3632	unregmp2.exe
Token: SeCreatePagefilePrivilege	3632	unregmp2.exe
Token: 33	3972	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3972	AUDIODG.EXE
Token: SeShutdownPrivilege	392	wmplayer.exe
Token: SeCreatePagefilePrivilege	392	wmplayer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
392	wmplayer.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2208	392	wmplayer.exe	83
PID 392 wrote to memory of 2208	392	wmplayer.exe	83
PID 392 wrote to memory of 2208	392	wmplayer.exe	83
PID 2208 wrote to memory of 3632	2208	unregmp2.exe	84
PID 2208 wrote to memory of 3632	2208	unregmp2.exe	84
PID 4052 wrote to memory of 4908	4052	msedge.exe	102
PID 4052 wrote to memory of 4908	4052	msedge.exe	102
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 1708	4052	msedge.exe	103
PID 4052 wrote to memory of 5004	4052	msedge.exe	104
PID 4052 wrote to memory of 5004	4052	msedge.exe	104
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105
PID 4052 wrote to memory of 4392	4052	msedge.exe	105

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\sticking-out-your-gyatt-for-the-rizzler.mp3"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 2336
  2⤵
  - Program crash
  PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d0 0x240
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 392 -ip 392
1⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdd1b046f8,0x7ffdd1b04708,0x7ffdd1b04718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14435681046911316257,13442078294276145358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
239ea3b185292fac91f1939d6178e40b

SHA1
7940f5eb972d6189a338c3d49a8f20be38ca8b6a

SHA256
26ab3e209cc36febcbd663c9217174a38f6767643fe2aaf402470507d91ce1d0

SHA512
9aeeb3184f91acc7171c45e174f052165663432864a0bb7d5bd24ca156a59c950a4fc55bcaa57d8f0a06a04513c1bfdabe626450d03a22cc43f40cd9ce3d78a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ecc89c76528c3a059507e3c90210c79c

SHA1
029e6d2924a38d95f085d2b9f0205aaebe2880a7

SHA256
e0093274bc04512f4e661fb92aa5e440cd55aca3b76caa40ffa4b105ea08308b

SHA512
ce9e4f6ae48c26844af0ea3c27d4f7e634513b756e1bcebefb44df3aec073f063ac1a28d836d3930168b72e45682d21e083d68a85cde9813cda841328d958f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
790B

MD5
3270da058860cd52199f66b3dca5cb1e

SHA1
fe2061d701991415295be24f3aee7064a61726bf

SHA256
e9e86c7403c8a78b98d6089e30d9a3a30e3e491194669a970e71bfdaf1c924ac

SHA512
d3d21f59810298f9248dfce8c747bbe801e0c3992f4982cc86337a2aafad9456112a9310977d8f03f443e903438bc2614df860275e329ddbf4f53bf404cf8b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf7ee099ba348989df64355464f77be0

SHA1
45fdc61407db596d4801d26794ece4f5a13bba9b

SHA256
c6b7121e3fa53ee34b41a1a2a70297b595defe6197427a507cf0bbbbdec6f8a7

SHA512
177b2383391142355451bbce6b34d23113b2316e02c10400bb028050b60a86fb41f6472e2fe35e859724385800fec39e42d6f3b305396bb8c4e622960d28ae1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1df186973ecfac67ab2d8bd61b959717

SHA1
79787b10cf15b4e697cf3aa08298624925a935b4

SHA256
d7dd1188999e6aa251bd3a00df976f3941fcbfefd0ddbc90373ea728e56ae881

SHA512
6df70dce61504026f51599834ace328518c9cb4e21c002eb26ececa67389c86ec8ce1ac82f832661508886f5683d1db0eeed9419f87a59958b192c156c714513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9cd3e2b7209c549bc3be3473da8a16b

SHA1
445e7e1e2b5e55e0faea88fea9bed1607e36d19c

SHA256
c75aab09f57d57a42aa488feaa4ebc157584e353d51205e2dd39bf8e9d15d389

SHA512
051bfbae2cd9388ab9e2e1ae3d8d204c20d5efc45af28dc128c06283820c1fbaf23164393a64ae54d7c3ae6614e7ea69ccce2d812dcdbdfe176a3294cf10c52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a30f9518c48c3564fc0170d17186f5f

SHA1
36219cc42b3c74173ea482ca4eb28f212be08fce

SHA256
8e1fb3dd377acf92d68e6359c0840870ea2651f16865551c71896a2a020e36a6

SHA512
8dc19f65f6e1d6584120a30530e70ce049382b046fed9947ffab9bce1001332e438dec1e68b668814b4eae523a8527cc2fd5aa1b7d69c352dba16d99b4136e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59922516fd77fa03defda22386ed2bae

SHA1
9b4195db3af9202e617840dc44961ff9ba5a1270

SHA256
5d78dbdaa3708dc0f98ff54abb7f9b6dd4a250abc2e375c73bbe697ac49854aa

SHA512
e11c68d4dd8f81f34dbcae7974839faddffda7eea9845ce850c6a477965b7d2ae41f8a325e7d145ad20b52433f89f827624ca7d79447366e6db5a41b3baff479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e43132951b52311e20eeff4b0f275d25

SHA1
7399b7f498d8648f1eb4a663070d32121d7001dc

SHA256
9a129edc89f923cce0252dff5dff39931bb989ebbc0740e229d2720a6ae1e28c

SHA512
81734a09576856b743fb4a0860fbbb437e0d62166df63c97f55ba47f1343c89df036eecf7a6381474199fd39d89e38f73c5bf737d5d5982266dfe0d3a1545a33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5888b3.TMP

Filesize
538B

MD5
bf8cb2aa107f348cd9a3db1f802e2b4e

SHA1
298ded96b837fd6c68a45fa2f25d4587a652cb06

SHA256
c625a5f24eb9c8b507ccc92cd0d45c503654fb766aad64fae8e027d3b54abef6

SHA512
60d7f3248b24b079dbbac130b467d4819924788f7149c8888ad9b4ec59cc3734f0f3e71bbf6490374114c76414d8d5f3a353b7919a1ed182410c1cc06a77d5e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b5f3bc21555cb83e810081175f64c744

SHA1
c515a343c4a5f9455a89f11e6dda21d589fd7ede

SHA256
9deb2a82a8b6fcd57cdede54ec55f1149da90422d65c1de4182893f760849360

SHA512
d149fc071a6047bd3e7d2d1afb28fff6135db6b49c752fffdf8441a6e47332d4f61bd800957d2fd3b2022f4c38de080f135df01e86158254ffa1dc69135bf3b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab71a566a805475cad3394d088ad0bc8

SHA1
d24584eb1dea7569833d3589599296d778fc1704

SHA256
0b3c2235d9d4d9c254d2c542594ebcf633c411e6256e582b09ec4afa715c3bc4

SHA512
66d7077866cb7d35672bcb95d3830e7368c14863b031941677644be339b8ea2467f9db2c617f1ebb7b99550b1da338326a8df96ed345ef25cb86e09e0156d451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6a1cb6e044bfb57ddf2bd81c2a628cdf

SHA1
78aa3ff96af3e6726117f66c728c4b482cd91cce

SHA256
ba72511cc953179b4175c1b28a74412b56575894659f93e905412d30b2ce836b

SHA512
d1fff5df8cd459709dd186f0501870445967d3709a3bd53b8ab73fde829f939ec8a1d45bc791628fd21d587f50d2167db6547068e9e652bb9929e1b089ff3203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
44034edfe4f082bb1788d06db61168f3

SHA1
b3b76f64f6bb9caf63cd04bf0ae740f5b2d903f0

SHA256
13f01b57059d7560ccee632025d275579b80ea0a3fdb3579022eb685bfbb4a6f

SHA512
062cc6e22a01051798041931355d3e72dc0f873173b84ba39784cf73fa38b8b764e6fa3a993ac04a7f37cb9ae20981472fe901f8bf25127d7b9ebe30aaf19139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
987a07b978cfe12e4ce45e513ef86619

SHA1
22eec9a9b2e83ad33bedc59e3205f86590b7d40c

SHA256
f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

SHA512
39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
3754567e836a33723aabc9e97b992848

SHA1
a4433e85b4e51f2260a3b9deee4af091bd1b6720

SHA256
9a0bfa92c8f5744f5704842a8a4947aa6e47c67cce8a3ab855e2c1cf0efb47ad

SHA512
1d9fc1d0c02e2834a8e88809778720b5f0532f8550de69f624908b23121e01f8b1e31d5de9065c10afc9e46f1ef7dc5c8ffd814a41afe7d49e9b0def717116dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
0bcaaa632fe108d6a8301fb3f793ff49

SHA1
3f3f8b10020c347316dac69826160cf1285e78dc

SHA256
c320037c4e60d788b97a040e593860d5b2bce26da1bffde8bb754549595102fa

SHA512
3280ad9c1385fd70b30fcf1355bf20f3dac66c13e54d0e0ab129888525d2909a30b7bd7696e0827690f0f01929391e6c06e7dbdd2b8f9f097c4b9f5bb46f02ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
37f58068f78cb5db36b5033608b89754

SHA1
9c3ef51c86a594cf12237cb6f6c04ec833def6f7

SHA256
6dbff5423867de289e70503e0783af18244b58d7d881cbbd9c79ee9e155fd315

SHA512
445cdab6668c0e04f8ecd0431f21b12f932b1cdb9788c0ecd520932f2e68816f742129ddcde8af3caf977705a86572ca06e5848129ad053ae569d5a585f9d27d

Download Submit
memory/392-49-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/392-32-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/392-33-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/392-29-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/392-30-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/392-31-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/392-28-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download