1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8

Resubmissions

02/09/2024, 19:47

240902-yhtwnawbqm 8

02/09/2024, 19:44

02/09/2024, 16:42

02/09/2024, 04:27

02/09/2024, 04:25

02/09/2024, 04:23

02/09/2024, 04:20

24/08/2024, 02:54

Analysis

max time kernel
187s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sticking-out-your-gyatt-for-the-rizzler.mp3
Size

175KB
MD5

27b535b4401ff51e152ef5f6fdaa2b5c
SHA1

eec3bba56eae9ff73d527c3638f3515d1c60da9b
SHA256

1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8
SHA512

9e322aef6c0c41f16fd0e101b89766032240570addba1a3be77b48207bc60c50a9ec3fbe82da9925d8d878ef111b625e629c05ee3dc23e30df10f8c523c8515e
SSDEEP

3072:nU/Sk+yOMHjhLbJdTJ/ffFFxEuy1hqFXNQlPgoTzS+GpQE4pCUW4hkFTMRsHeV8L:nUK1yTdLbJrXPxEuy1jFJkpaxBV6

Score

8^/10

discovery evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	3564	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4032	taskkill.exe
1728	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{53C9B428-AB8B-411F-BDDF-45E82A23EF6C}	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{DA7210B9-585B-459D-A9B5-C7BF6D902AC2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
3464	msedge.exe
3464	msedge.exe
712	identity_helper.exe
712	identity_helper.exe
5460	msedge.exe
5460	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3564	wmplayer.exe
Token: SeCreatePagefilePrivilege	3564	wmplayer.exe
Token: SeShutdownPrivilege	2672	unregmp2.exe
Token: SeCreatePagefilePrivilege	2672	unregmp2.exe
Token: 33	3932	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3932	AUDIODG.EXE
Token: SeShutdownPrivilege	3564	wmplayer.exe
Token: SeCreatePagefilePrivilege	3564	wmplayer.exe
Token: SeDebugPrivilege	4032	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3564	wmplayer.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3228	3564	wmplayer.exe	84
PID 3564 wrote to memory of 3228	3564	wmplayer.exe	84
PID 3564 wrote to memory of 3228	3564	wmplayer.exe	84
PID 3228 wrote to memory of 2672	3228	unregmp2.exe	85
PID 3228 wrote to memory of 2672	3228	unregmp2.exe	85
PID 3464 wrote to memory of 4812	3464	msedge.exe	100
PID 3464 wrote to memory of 4812	3464	msedge.exe	100
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 516	3464	msedge.exe	101
PID 3464 wrote to memory of 4988	3464	msedge.exe	102
PID 3464 wrote to memory of 4988	3464	msedge.exe	102
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103
PID 3464 wrote to memory of 4420	3464	msedge.exe	103

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\sticking-out-your-gyatt-for-the-rizzler.mp3"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 2352
  2⤵
  - Program crash
  PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3564 -ip 3564
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9884446f8,0x7ff988444708,0x7ff988444718
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,3071902631548322149,14646428583177152881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5180

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3500

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Trololo.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Trololo.exe"
1⤵
PID:3616
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4032
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e5cc953e78c42346ef542515d9e1fad5

SHA1
9a271ebf108a9400b9f9f6d50015260dbe2af142

SHA256
9305403c7ff436d48218fc0203f5b87d1cbc8a31032d092f42465b3b9f588650

SHA512
1e242c3adec0c17b64b1fa196083d5fbf4c6c83ceff32708cabb5b33338a22c11cc3f69c9cc4771843a4147f9c1dd7f187d2d1807e4a37502ad7f4301f85e19e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
859B

MD5
c66bd4272479bc766c185a28878ed654

SHA1
c38a9e5aa4752032dc4472fe6ea54ed2eaeb5482

SHA256
82deab5f54a80132d7d1a12258d981fcf081b7799315f2de793e2d6e3ada138a

SHA512
a94c322cfd26481a341ac4c2380941454504e84aa45aedd0c16c744a95eedb5fa09bff032527b30415db5596b82b0e26d4c20a224dab040770247085017d4fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce847c2b1ed1a4af8be2253e621dc226

SHA1
0b3d62867d496ecb965bd15ce42538738cce073a

SHA256
b926fb50c5a912074e501e4892f005c008d6a6d0d03eb96d736eebc356f06459

SHA512
c08228f051c381d76cc235a5c180c801f14e4c9bdfb6a3841cff7a5146b78252083701751e47e0d8352d5911645d324aa9fbb6180d5286cf8b5239da415f76ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46874958f59e204143e19dad86c4bfc5

SHA1
4f0f351b69f6b6137d277868de6a0a2d71f76e85

SHA256
f3f13f6f91bc9cf653d8cb5f5fcdfdb5cb32fe0f323783421eb1cf428c564809

SHA512
73b1838a01905f5cadad7ba4db75f0ee7c0f4b8f727d00226b8eeb9289b13f780a0487efc80b605ff3ffa76b55bfb88376939f935876594863d0309d9e20def0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bacff5c143019189bb80f80f9f5cad64

SHA1
b5028e71b4ed17896ff0a8a2152f576449c7aeee

SHA256
521a0bdfff066758202a837ed0de548d417a1d00116dc9b648bb5b14c5b83df0

SHA512
2f6ca52532c95cb6ab769f9516d3f432f7914a5f83ec138cd094e588f7fe796b0a75df050d19a3b9f9a3981bc2a3b59c690ff3dc19e436fdae35dab34b188620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5218f1dbd69110c34922a7f3fe0ac38e

SHA1
5182cf881956c6fd19379cb79f11aadfe6795d60

SHA256
9c264f6854d0395f9b584bb9695805312137c65ab146dd4135279cedff8942c6

SHA512
9fb483e4bc8878fed52219b89b6000768cfda2e47705fdb9d76894cf17223fff05912a1dec52b221a5bc5667bcc6f54a9d19c149c8235e606fb7ffd0ff2c8522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
63f57f62646aee32f5c3663e056a4081

SHA1
6be9407d57265a9cefe25b214b457597d3da5361

SHA256
b78304a5a11b71026eae7a698916a1e91944e099af17b548c6a78a158b86d57d

SHA512
580a443d3c3f01a0099fab934475f802f1291c430fcc9b9cbf64f9ae398d4892cabade9bcc9f9bcdac0fefe728ec8806114b8f56012f11bc329de7b50370c9e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6f4c02427499409127e46844c35b5db

SHA1
4f9df61e6ecf75215f9debe398b39506fa1598e7

SHA256
28be60a710b980a2abea220538c2a481de7a076cc2590c2d7f10a8ba58930e3a

SHA512
f1655703c77a4005a8e63a821f76f2a6884f446388434e1dbdac30ddee7e0c07b10c33e45c323a5308150be729cb82c1dcdc48bbcd53b06c4dfd19a441b4c91c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58343a.TMP

Filesize
536B

MD5
42630acf8021e4a2b449c5c6862d322d

SHA1
5e5cf6056e554d8c15b9dbfe08148d4d8bfcdb84

SHA256
6ec591aca9d1576ea9aeef791f5f13b358bd19e77c8f953772a79fd4396f9b83

SHA512
e636e6dd86f0d236347889eadc4c3aa57b31523a9460e55f406cfe5994937dd67be71762a0125d43a550899ae37b69dafc839c4941462e54013721b302dbf4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f6f1d1b0d89a8771cf06094f88ff5779

SHA1
21232bdca6b107f5b0704f273290ffd9aba9669d

SHA256
afa5b2ff1511903617c635b8ace80d15edafb05345d2f134a4f11ee63ceb65c6

SHA512
3f87acf3d57a5030f417d385d0046642ad039581d1cfb6e0a3420e2ee3eedce1997436737c04175401e7c5aa42989820e2860da6bd6f11d9324a8e53c329e7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
022d717ec1f6bb91e9d4950a6262f2d0

SHA1
42b423fbbaac31cfa7a58bb47927be72da51e3f3

SHA256
f3382c0a76230f1a38f0ee0d90af1e4cee3dfb832256fddcbd73d4df0d12d851

SHA512
7bc718ae61013b988c070d44483ed0f9827a7baf73c41646cd2425f0acefc5007e6700d9ced1bd44fbc75a9404eb0ef70da801f6fa867a74b26bdfba43e8e4ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
512KB

MD5
946f3d332664c951e4220b6529c08cf4

SHA1
8cef2495aeb0b14c503c53fe51282e7bdfa487a1

SHA256
def03bbc743e3f1f8e1e7c235e05180fd3501857547d59eac77034bb17f54d16

SHA512
a6ed17d51b299c250d9b50385e5a0c7c35dc388062d3d448fd2d55a001928518fb18f84a38a692af85d8f4b40b5e3a767724a0060702c842ac0bf8f83f9a67bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
71f3257c2a00a4e9d79c1642451f1703

SHA1
d1930a59a533dc9fd2c6c5849c19e1f2882601b2

SHA256
f7d094b0c48f24122cbe5e8120025681e150248fd1affd74243063784b97e9b8

SHA512
e2de9a286a2e7d5da58560de592e94566f462e56bec22104f2404d81751898873df18468efed9f6259423e633713d2c7a73bc7cc6d424b9600a7d6371d84928e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
484d74af619b9f390c821e40d0e134fc

SHA1
0c2c0fea83a33e1b00b47a891cd2eb8fd2c21d1a

SHA256
f4a35288544bac171c0f1156bab591f673b818971099a27c7b0631dcebc37abf

SHA512
582712e88b340bb58b2facb587c476c941ec5407df06b0c6cbf45cb3014ed5140d83b4850795bdf3c450c57127e64335221866bab37057114ac23c4145e72161

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
0c037da3932c9724ccef0c8b1eb9824e

SHA1
b83f36bbf7fdd5b768d771cfef9282e84889a5e9

SHA256
06e59a0f60873b8d006ef055ff22b95973bf280add053be428472922e44b307b

SHA512
766d638a490bb1aa15c1c05e46bb359735da1f54a5a22d64a7a18603e4565f36d8e853d0e1b660f01ef2a94ae987d70466476c807c19c689251e83e0ea2d4c2c

Download Submit
memory/3500-602-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3564-32-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/3564-30-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/3564-27-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/3564-29-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/3564-28-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/3564-31-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/3564-35-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/3616-597-0x000000001BDF0000-0x000000001BE96000-memory.dmp

Filesize
664KB

Download
memory/3616-598-0x000000001C380000-0x000000001C84E000-memory.dmp

Filesize
4.8MB

Download
memory/3616-599-0x000000001C940000-0x000000001C9DC000-memory.dmp

Filesize
624KB

Download
memory/3616-600-0x00000000017D0000-0x00000000017D8000-memory.dmp

Filesize
32KB

Download
memory/3616-601-0x000000001CBA0000-0x000000001CBEC000-memory.dmp

Filesize
304KB

Download