Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 15:37

General

  • Target

    07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe

  • Size

    1.8MB

  • MD5

    30ac84841a731fa47a3ce25033db8449

  • SHA1

    7c2c107362576bd653e0dc6f96be4d7295d70889

  • SHA256

    07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4

  • SHA512

    d56c10c8af777e516ed343544c7b17eb5b1a9553c283da53728013adf1e5d572cf290be6502d25b42f8b617b36a754c39a320dfa4eb545e382de3689a3547e9f

  • SSDEEP

    49152:g5kAmXhdOEgEjSVfpIfEA9fXK92mGWuYn7KU5:gW/sVsdWLnGU

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe
    "C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Users\Admin\AppData\Roaming\1000026000\6367b20d77.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\6367b20d77.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2716
      • C:\Users\Admin\AppData\Local\Temp\1000030001\690a15d7bf.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\690a15d7bf.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4516
      • C:\Users\Admin\AppData\Local\Temp\1000033001\df653ec2bd.exe
        "C:\Users\Admin\AppData\Local\Temp\1000033001\df653ec2bd.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4664
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc534446f8,0x7ffc53444708,0x7ffc53444718
            5⤵
              PID:2980
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
              5⤵
                PID:3460
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1072
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
                5⤵
                  PID:4420
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                  5⤵
                    PID:688
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                    5⤵
                      PID:3256
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
                      5⤵
                        PID:1340
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
                        5⤵
                          PID:4056
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
                          5⤵
                            PID:4036
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                            5⤵
                              PID:3380
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
                              5⤵
                                PID:3060
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
                                5⤵
                                  PID:1496
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
                                  5⤵
                                    PID:1644
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                                    5⤵
                                      PID:768
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                                      5⤵
                                        PID:1532
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
                                        5⤵
                                          PID:1796
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                          5⤵
                                            PID:4968
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                                            5⤵
                                              PID:3100
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
                                              5⤵
                                                PID:1896
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
                                                5⤵
                                                  PID:116
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
                                                  5⤵
                                                    PID:2584
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
                                                    5⤵
                                                      PID:1852
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
                                                      5⤵
                                                        PID:3128
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
                                                        5⤵
                                                          PID:1272
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                                                          5⤵
                                                            PID:216
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
                                                            5⤵
                                                              PID:1720
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
                                                              5⤵
                                                                PID:2000
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                                                5⤵
                                                                  PID:5436
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                                                  5⤵
                                                                    PID:5508
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
                                                                    5⤵
                                                                      PID:5668
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
                                                                      5⤵
                                                                        PID:5016
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7532 /prefetch:8
                                                                        5⤵
                                                                          PID:5784
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7532 /prefetch:8
                                                                          5⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5876
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9891914956084530997,12756883425256968112,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7452 /prefetch:2
                                                                          5⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:6044
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:1636
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:5676
                                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                      1⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5184
                                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                      1⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1768

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      a1c39ed1aa80793a3d95e26980593dbb

                                                                      SHA1

                                                                      9226fd38d1ac36c2332d982a3451a959d107ab0c

                                                                      SHA256

                                                                      5611bf6098ed7d6515259e43bfada824b76651cf9be2aad431155d3785933862

                                                                      SHA512

                                                                      6ef37bb8e03cb644fa103f6947755259b85365a9746f7c3509f116ba0dd6c41940c19a45ceabacb57701db333666b8ad6d2167e884ec4b0a5c8955936967b460

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      25647f6274eef6e912d14f4278414579

                                                                      SHA1

                                                                      eff66589f6bc98ff07e869aea4fd09c75e576078

                                                                      SHA256

                                                                      f58e19241538c9527b24c814a3fce8ec6b07113af9991c7eacaeea9bcf2885f4

                                                                      SHA512

                                                                      d9cc0ce117a648dc39bb4df26028a134911fea9402219af6b985df56c973d24d31b1aaeab0f61727a5cc4d477c18e5aef9bc83661f55a8246f001cc5c136a8e6

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      1de2eb7fcc57c2bbe63b9ca0a3f983c7

                                                                      SHA1

                                                                      ff1de34bc3052ac9084863936aad87e7eb56adff

                                                                      SHA256

                                                                      9e401769488a7b963693d5d8d56daefe31eae027f35f270a86ce9f614bbfe3ec

                                                                      SHA512

                                                                      6ab5469bf48c0a6e3cb0ba864b7887ee6f0d03c142c09e1b1e33e4935260b15bb876e5a24312fe589d5ac1f8c77eb4499da974e1d06748a3d4c9797e402c0b66

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                                                                      Filesize

                                                                      20B

                                                                      MD5

                                                                      9e4e94633b73f4a7680240a0ffd6cd2c

                                                                      SHA1

                                                                      e68e02453ce22736169a56fdb59043d33668368f

                                                                      SHA256

                                                                      41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                                                                      SHA512

                                                                      193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

                                                                      Filesize

                                                                      41B

                                                                      MD5

                                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                                      SHA1

                                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                      SHA256

                                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                      SHA512

                                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      feeeb2dc87f22a466d8eca4c4d283de3

                                                                      SHA1

                                                                      001156d321bfddeb4ed8854173321f857a86fc4a

                                                                      SHA256

                                                                      7ba9613d323325b4e03d90238947755824429d226d59e34130c5686a6684cd43

                                                                      SHA512

                                                                      a97da410dae3944a054acdb8c8278eae4b87f53ab776f77de0b7ab862051aec70eabe15fe47e9760defb72d862d0263f68faf5258c65241ab4c96f3aaa06828e

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      209f7f31a1c8f9791f73b47f112fa97c

                                                                      SHA1

                                                                      0a1cff940ec773a12dc0ce2b4fcb5a42acfe006c

                                                                      SHA256

                                                                      eb3041fc3667fed5d24cd78cc5794b52b37b062434130b8e5a15453e981f62ed

                                                                      SHA512

                                                                      574fa8e6660adf40cb57294d72a8eeb691c496752f0b1b819106e709823b4ac466a274b7cd78325a097f2033b9a48a8cd87bb932892042295009d728ad41fefd

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      bda084fe39376bd527b531854068505f

                                                                      SHA1

                                                                      14bff307ba4bd0270a931a541890f34c96f570bf

                                                                      SHA256

                                                                      db9761d28434d99f2f4897aaed6afa8e0155ba1245966bc2bdabeaef51391755

                                                                      SHA512

                                                                      1b49f7c37b3fc18dbcb9fd732b7058c41ece402ea51b2422996c878d2bc2985a08d18605c92f850f7e5af342c55241389abcfbf76d94ac0356abb8851f1f1336

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      bbb34c01beee2f55191f7440c14875de

                                                                      SHA1

                                                                      00d2670029645b409a7f06534f9baf886e5f4781

                                                                      SHA256

                                                                      083e1777873f3fb5807c83e97a2991e840a10d9611b4e0f0cb83f6adee85f292

                                                                      SHA512

                                                                      4d447e32afb20f84189866495a9e57b389d109fc51ae4297c8f0cbe5500cb034f3b78042f275c4341dfadbc0219124e29d379710709925177da8a70bc847771d

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57e186.TMP

                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      bd6d14af8f82fdc2ae2b294448473041

                                                                      SHA1

                                                                      d5073df8a121420f784d37cf7dc562afc5d013a4

                                                                      SHA256

                                                                      9d897408698a5eccb75abf886d7bdb20900da7b8785f9309ef02a0f19e201d90

                                                                      SHA512

                                                                      bcd7d0e14582d258d9777611bd10b7f67e20164526bf18c51a65752a1431bb8e9e52da81a657363291755982601a9994630939eee4bfc7b9136a70bc5a490fb1

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                                                                      Filesize

                                                                      24KB

                                                                      MD5

                                                                      36116314883d7247f3bc6cc89610263d

                                                                      SHA1

                                                                      ba65b26a2498d0004080ce515e7e45a7b6075210

                                                                      SHA256

                                                                      37325232bbc7c978d7235f30f2574b430f2ee9798eb1760091274f35e61bddb1

                                                                      SHA512

                                                                      1c0310266e1cec78873bf006b036a1a340bc8c2454e7c5da1454fcd1690b44485298504c5834e2c89c8afe0be242c204ab762cfeb021457c0128f32ab20e61fe

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe580b36.TMP

                                                                      Filesize

                                                                      24KB

                                                                      MD5

                                                                      c1bc1417e8f6e80e97ebaaf862691498

                                                                      SHA1

                                                                      a45b84b5f3b7d86f03173111e730521e4d05eee1

                                                                      SHA256

                                                                      56bb26315cc5a838d168b0a7d1e98fec101ade243c95554b4ec28c5b7551207b

                                                                      SHA512

                                                                      9813cbe0519d91d3bee32de7e4d68a71048180ec7b4ae5f24e30b8b109f4726e82743d3896e08358e68d86759bbe2a906397264adf834a4fce50dc84f4935631

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      46295cac801e5d4857d09837238a6394

                                                                      SHA1

                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                      SHA256

                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                      SHA512

                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      cf89d16bb9107c631daabf0c0ee58efb

                                                                      SHA1

                                                                      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                      SHA256

                                                                      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                      SHA512

                                                                      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                      Filesize

                                                                      264KB

                                                                      MD5

                                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                                      SHA1

                                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                      SHA256

                                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                      SHA512

                                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      0962291d6d367570bee5454721c17e11

                                                                      SHA1

                                                                      59d10a893ef321a706a9255176761366115bedcb

                                                                      SHA256

                                                                      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                      SHA512

                                                                      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      41876349cb12d6db992f1309f22df3f0

                                                                      SHA1

                                                                      5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                      SHA256

                                                                      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                      SHA512

                                                                      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      206702161f94c5cd39fadd03f4014d98

                                                                      SHA1

                                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                      SHA256

                                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                      SHA512

                                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      8adb35df45869ff2cee07cd137588ed9

                                                                      SHA1

                                                                      a9a590866d743d5604a58554cacb33943baa3de8

                                                                      SHA256

                                                                      374801056821c2229cc719bc4324d43373031d5f3a491c2b5bf707740eae8d77

                                                                      SHA512

                                                                      d29af73da829500a8a7e4de842d8d8911c83664e225725429e8e3b3eb24f2befa32ba27b169bcd60130599344c022f49cd9e3afb5d1100c876c729edf2db5497

                                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                                      Filesize

                                                                      1.8MB

                                                                      MD5

                                                                      30ac84841a731fa47a3ce25033db8449

                                                                      SHA1

                                                                      7c2c107362576bd653e0dc6f96be4d7295d70889

                                                                      SHA256

                                                                      07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4

                                                                      SHA512

                                                                      d56c10c8af777e516ed343544c7b17eb5b1a9553c283da53728013adf1e5d572cf290be6502d25b42f8b617b36a754c39a320dfa4eb545e382de3689a3547e9f

                                                                    • C:\Users\Admin\AppData\Local\Temp\1000033001\df653ec2bd.exe

                                                                      Filesize

                                                                      896KB

                                                                      MD5

                                                                      2801358ac519754c48b748365a57fdc0

                                                                      SHA1

                                                                      c8e7b39b9172409eabcabe54b2a224d1a24e328a

                                                                      SHA256

                                                                      563f6936421d587af73cab59d466deb7bfe961fd7bb119b3366f20bb5be45915

                                                                      SHA512

                                                                      2b21599bd4d9035e3b2c367342c824c52133c28e0b4103ce1bd5933bc15b6380d56a694fa97fad973fe2b8a37115b3cbb9ab4a5c13fabd76a6c750e97d04c2db

                                                                    • C:\Users\Admin\AppData\Roaming\1000026000\6367b20d77.exe

                                                                      Filesize

                                                                      1.7MB

                                                                      MD5

                                                                      110750350e3f833d4de59ed0c7dd1b08

                                                                      SHA1

                                                                      ff21c68dad2c4733ced39aabd130e0406a56ed58

                                                                      SHA256

                                                                      d89f747d96c84dcd1a704731dd4261f6eb69f1498a05cae00a4635169ce5ec20

                                                                      SHA512

                                                                      df963df25b627e0aa446c0170acbfd3589d0b243eae8c34d84cd77940ee1d58b90f4a4739c10053eedd3dc1036a20aaf8cf202c8ed991b487712137ec0d52493

                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ORTNC7QIN0EWFN5RXXSL.temp

                                                                      Filesize

                                                                      3KB

                                                                      MD5

                                                                      14ad7690471a8041a0774fe1fc0492b0

                                                                      SHA1

                                                                      4a01f217c101fe6b85be112121d89d98a6ff5e93

                                                                      SHA256

                                                                      be434fa1893124b1874a5dc94a5389302ae7947ac588dad73568768b26cf518b

                                                                      SHA512

                                                                      8c7a22e48dd751fb373ab52260c0dd1df44501389d3208477cbebdda34b41af05821d27cee118750841105b88c48f2d17be999d72e01601f0a889f4df53e6e58

                                                                    • memory/1768-406-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2716-54-0x0000000000740000-0x0000000000DA9000-memory.dmp

                                                                      Filesize

                                                                      6.4MB

                                                                    • memory/2716-38-0x0000000000740000-0x0000000000DA9000-memory.dmp

                                                                      Filesize

                                                                      6.4MB

                                                                    • memory/2716-57-0x0000000000740000-0x0000000000DA9000-memory.dmp

                                                                      Filesize

                                                                      6.4MB

                                                                    • memory/2840-339-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-413-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-410-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-205-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-260-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-407-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-22-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-21-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-19-0x00000000008C1000-0x00000000008EF000-memory.dmp

                                                                      Filesize

                                                                      184KB

                                                                    • memory/2840-286-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-20-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-18-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-404-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-403-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-402-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-358-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-224-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-359-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-401-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-382-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/2840-372-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/3344-3-0x00000000003C0000-0x000000000086D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/3344-4-0x00000000003C0000-0x000000000086D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/3344-17-0x00000000003C0000-0x000000000086D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/3344-1-0x0000000077D44000-0x0000000077D46000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/3344-0-0x00000000003C0000-0x000000000086D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/3344-2-0x00000000003C1000-0x00000000003EF000-memory.dmp

                                                                      Filesize

                                                                      184KB

                                                                    • memory/4516-55-0x00000000000F0000-0x0000000000759000-memory.dmp

                                                                      Filesize

                                                                      6.4MB

                                                                    • memory/4516-261-0x00000000000F0000-0x0000000000759000-memory.dmp

                                                                      Filesize

                                                                      6.4MB

                                                                    • memory/5184-362-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB

                                                                    • memory/5184-361-0x00000000008C0000-0x0000000000D6D000-memory.dmp

                                                                      Filesize

                                                                      4.7MB