vidar | hxxps://www[.]mediafire[.]com/folder/3is42kz6mwjhj/Files

Analysis

max time kernel
242s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/3is42kz6mwjhj/Files

Score

10^/10

vidar 346a77fbabba142b23c256004b5a7c5d discovery persistence privilege_escalation stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

346a77fbabba142b23c256004b5a7c5d

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 22 IoCs

stealer

resource	yara_rule
behavioral1/memory/4972-957-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-959-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-966-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-967-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-982-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-986-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-998-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1013-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1017-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1020-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1022-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1023-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1027-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/3992-1028-0x00000000004C0000-0x0000000000735000-memory.dmp	family_vidar_v7
behavioral1/memory/3992-1030-0x00000000004C0000-0x0000000000735000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1033-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1057-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1058-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1068-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1069-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1070-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7
behavioral1/memory/4972-1071-0x0000000000600000-0x0000000000875000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
1904	7zFM.exe
2192	7zG.exe
5980	S0FTWARE.exe
4200	S0FTWARE.exe

Loads dropped DLL 4 IoCs

pid	Process
3412	Process not Found
3412	Process not Found
1904	7zFM.exe
2192	7zG.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
628	bitbucket.org
629	bitbucket.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5980 set thread context of 4972	5980	S0FTWARE.exe	170
PID 4200 set thread context of 3992	4200	S0FTWARE.exe	173

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BitLockerToGo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BitLockerToGo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133719307945306984"	msedge.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{F5B7DBE6-894F-453F-95E5-E33107E712FC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{6C608D95-EDF4-4B9F-AAE9-E73C5EBC9624}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1072	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5436	vlc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
6112	msedge.exe
6112	msedge.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe
4972	BitLockerToGo.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1904	7zFM.exe
5436	vlc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	1904	7zFM.exe
Token: 35	1904	7zFM.exe
Token: SeSecurityPrivilege	1904	7zFM.exe
Token: SeRestorePrivilege	2192	7zG.exe
Token: 35	2192	7zG.exe
Token: SeSecurityPrivilege	2192	7zG.exe
Token: SeSecurityPrivilege	2192	7zG.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1904	7zFM.exe
1904	7zFM.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
2192	7zG.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe
5436	vlc.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5148	7z2408-x64.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5716	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5436	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 5424	1216	msedge.exe	137
PID 1216 wrote to memory of 5424	1216	msedge.exe	137
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 6056	1216	msedge.exe	139
PID 1216 wrote to memory of 5700	1216	msedge.exe	140
PID 1216 wrote to memory of 5700	1216	msedge.exe	140
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141
PID 1216 wrote to memory of 5720	1216	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/3is42kz6mwjhj/Files
1⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4828,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
1⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=760,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
1⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5416,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
1⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5588,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5612,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
1⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6292,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
1⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6468,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
1⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6472,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
1⤵
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6392,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
1⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6480,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
1⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6380,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
1⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6984,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
1⤵
PID:804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=7308,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
1⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=7196,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
1⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=7612,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
1⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=7752,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
1⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6260,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
1⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=4944,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
1⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=7892,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
1⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=8324,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:8
1⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=7628,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
1⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=7792,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
1⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=7812,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:8
1⤵
- Modifies registry class
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --field-trial-handle=6092,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
1⤵
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=8072,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:8
1⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6348,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
1⤵
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --field-trial-handle=6488,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
1⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6952,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
1⤵
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6928,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
1⤵
PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --field-trial-handle=7572,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
1⤵
PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7700,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:8
1⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --field-trial-handle=6768,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
1⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --field-trial-handle=7936,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
1⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --field-trial-handle=7404,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
1⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7212,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
1⤵
PID:3212

C:\Users\Admin\Downloads\7z2408-x64.exe
"C:\Users\Admin\Downloads\7z2408-x64.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x23c,0x240,0x244,0x238,0x21c,0x7ffeb8d4d198,0x7ffeb8d4d1a4,0x7ffeb8d4d1b0
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3376,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:2
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1868,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:3
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2220,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4512,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4512,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4580,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4684,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3052,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4884,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3436,i,193217413478510565,865493785031015135,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:3
  2⤵
  PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:5620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5716

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\S0FTWARE.rar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5460
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\S0FTWARE.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5436

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\S0FTWARE\" -spe -an -ai#7zMap32563:78:7zEvent2779
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2192

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\S0FTWARE\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1072

C:\Users\Admin\Desktop\S0FTWARE\S0FTWARE.exe
"C:\Users\Admin\Desktop\S0FTWARE\S0FTWARE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5980
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Users\Admin\Desktop\S0FTWARE\S0FTWARE.exe
"C:\Users\Admin\Desktop\S0FTWARE\S0FTWARE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4200
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3992

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2496
- C:\Users\Admin\Desktop\S0FTWARE\S0FTWARE.exe
  S0FTWARE.exe
  2⤵
  PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
963KB

MD5
004d7851f74f86704152ecaaa147f0ce

SHA1
45a9765c26eb0b1372cb711120d90b5f111123b3

SHA256
028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be

SHA512
16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
0fb3773e4722020c497c1553632f0cd9

SHA1
90a381adfd30a8248712e2d1eb98398cb4dd4365

SHA256
2355da1ec0bc034a3af4e6d9dd9d925ea1adc058035af3512fac4315eec72496

SHA512
8029e698a16d7aaa117698b6644278a5ad61a7901788d0dcb975f2534ca5bb1387b1adb19a45ec584400db66e3dc8af8837fd0f57456854f7901357f17475fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
9fea93af1237c1d911b024e452f6c286

SHA1
3c0f894b1833a8903cebb37526c3bb923914f161

SHA256
018cb837f663544ff12c1cd1819d7d0917ea8f52a06c1fe7099c4278f447feab

SHA512
6110bd07ad267ce7b6a4541094ed6a9d53f6195bdf968e7cd33f218b884da7b23f8b60712f58fded81eb88b9401b1421c3c9d77ca8c20ac63260bb4eabc3d9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
d449ab862a22d8d064aac8860f93e7fc

SHA1
fe0eff8952489ab888678441664575c4cbb192eb

SHA256
6d96f4c9269bfe2e9ed05d9aec1fb6945138acc753ed24af2fbd632a7814602a

SHA512
4b92e0044e1b171d71f38738f8dfed0db37df5cb4d9fcf426e569a7ea3151aef68b9c421754ef08d94fc7c15c079db744fb4d6d1288b4a35cf3a75c101e92ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
2a6af6bb7a9c2ad852912cab8d0ad88c

SHA1
3c3c608dd1c1be87ce0c55e2ca4a75727f97946e

SHA256
9139d1f489c4eda4ad778cb0f035fca083090f225cad7d8905014bfdf0b0622d

SHA512
a4b0b204b07b88e8ad98f3416ce9fd15b845e69c659adc8e335e37e3946efe6f7449944b4cafbac652ae055d1ef22434105b3159a924a9f4a1ff2cb9367b5f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
52KB

MD5
4d1c4b58a4fabef02619ab16c3bca9ed

SHA1
ceef2e2d56fa2d4a3760d99d31f30037a83d40ce

SHA256
8d88ea09d1bcf501a6837e9c7d2e9bbbbd93157349b92d211dbd0b783282c845

SHA512
9ec970b6e50157efa32839ed3e78ae5825749edbdb383c3948091b2f2cffe5fb23dbc594c5e5d899eea464c5f3b8b7022b20cd31b340941ec3c34e9dd4641588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
14KB

MD5
3b0177927340be35c7c27d72e66e48be

SHA1
25a9671a51a8c15b96a0a9c6c69978c013ea3039

SHA256
30eab098314bee7c3dc13051a99a02bd18418ab52498dfef4eb23248273c03a3

SHA512
0718aa07822671da57a34550eea468b984701d0209fb6b6a96ea92861bb838be43a156c54ea3e54d246c23ce9b2249b5208293e45dccf1b08eb32a95d5f16950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
c5e1007ecd218bbcf02bbd834168a0d4

SHA1
4af5a4e609d7378d44ecaca4cb4fb89bc3fd02c8

SHA256
d6d33907d0da70d635f981fbea3e6bd35720f36abc03f7390b3413a6290b0838

SHA512
edb0c339eccabb4a3837d618a1b9ab9fbcaab1ee459dc8ba65c36b7f72385d05469e2f29c43fa38a5f9cbd734e9180b99ba2cfb7dcffd0f91c5914b0af9de275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
023469fc20ce12fd3754db8dcc6ef859

SHA1
d0fe51b6e4db9171efc51234850cf2eaac701be2

SHA256
1c61ce85189495f407793735f1e975735ebb97140c50ee336c0e109e98457ad5

SHA512
702ac5e8f1d86ab1e45216c6a3e70aa63741a2a3b245a2ea2121d8c5f10857b607064376adda40697b3118f5b9765a7b8126a2688f0b75f796019d975e18e8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
91KB

MD5
a551ec780eea82c0e343012eaa1f21be

SHA1
2d87cfc924ce8f01910556b4356690f18cdad75e

SHA256
ab47c9e43eb2d580b0cc67a845bbb88368d526046a1783a15212364985b35e49

SHA512
88dc714ede810f8d014cd0bd1bebd74f55936ca695ed3c284731798238929b529f2b885e1c455f56796e19989c94cfa00778043c8b4b6caec9eae8810207edc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
91KB

MD5
814cedf202dfa9f96ae4f545db52b879

SHA1
a71fe305d9623f0179b3df0ffa7e957768a04963

SHA256
5c8ab41f4074c3d7867dc912c997a33493f8da03c8197aae84d45efdeb445806

SHA512
3381594c750e3c9f2d2f0ec445ed6385fb254f367b05c11186358ba7b9656aaae2e0595dc250ef73676a36a5b5370557bd4ee9855f7997f5f66b87c458d2eb30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
c684e753678e22711f739cdbc7daf521

SHA1
6d87540decdc625c7976b46b8365ccfccb6da1fa

SHA256
1c80a28e4a9b8be4fe7d4b9123dcf9fc2ec98a25bb31caa5103b5596af25e69e

SHA512
f8e19a1178c6a4e863581e661f454559d356f5b18c5e11a2e49a379f8a47fa27b35ceb526bd128e9e6f7ed43293b496438209c9666830f9a61f46a8d0bd9fd26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
95KB

MD5
6c1c6695686304fbb618da3bd58ee88e

SHA1
5adbcb6bd4ba0b25f9ff2949d03b57984301650a

SHA256
720176b3f943775a6cba8c67f1de6f565d63bcbbc59bfa4bdbc773f31ddfb7fb

SHA512
c606216a4048d0535ae949fdee6de01d9bf7489376704c09c8116927c1990c9d46959b0f88cb9a105630aaf6e2d542627b8ae7bebb36764b7d7fd1927ab63628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
f8b07db48106ff3bba101fdb86717b81

SHA1
8d3e228e00a6465f66fc4617b3509cf948b11e36

SHA256
54bd7b9c438e961afc0b031029069c3122c8adb53c557dabc4f6c8dda3c17008

SHA512
b503919224b89b4927ae00a4944a78a525e30b16803141dca1ca5273b7bfd8c379d67487df2c85aad2677a670fb3e4913d43fa14e2139447fff36e15444f159b

Download Submit
C:\Users\Admin\Desktop\S0FTWARE\Readme.txt

Filesize
244B

MD5
82d0a343d06f3aaa16c594284d6b1f6d

SHA1
9294bb014a3a8be3fc5c533f525ac7270b09bf51

SHA256
1a0655b5aa5b6d037e25893bd191323091025f1df92e6f8b4392b1889171da10

SHA512
de024359f7c3e247dfd61b3ef3be0f3bc65855e4863966345bfe99a9e7c21659e2d0e08ba50ee46cccd0e569633b4edf68e30050c8956005adb56500d263ad53

Download Submit
C:\Users\Admin\Desktop\S0FTWARE\S0FTWARE.exe

Filesize
18.0MB

MD5
a11bb3b18eba3f07561ca84c92c520cd

SHA1
c09ffdaa9b11747b07e88f669c70566a48134678

SHA256
7cfae4e35c049f4aad444cca84c5fcdd0f4da67b5a1846e821322a9f9757096b

SHA512
108e8153f76adfb5eb840a771b5af0c80396838363add14e05baf1b953ae19a684bed0648c2b4404d23d2a8f9a0ad2968b2f3e6d6a062c462a217a75dd9a85ac

Download Submit
memory/3992-1030-0x00000000004C0000-0x0000000000735000-memory.dmp

Filesize
2.5MB

Download
memory/3992-1028-0x00000000004C0000-0x0000000000735000-memory.dmp

Filesize
2.5MB

Download
memory/4200-947-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/4200-983-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/4200-1029-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/4200-953-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/4200-949-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/4972-1020-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1023-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-969-0x0000000021CE0000-0x0000000021F3F000-memory.dmp

Filesize
2.4MB

Download
memory/4972-986-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-967-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-966-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-959-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1071-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-957-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1070-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-998-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1013-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1017-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1069-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1022-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-982-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1027-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1068-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1058-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1057-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/4972-1033-0x0000000000600000-0x0000000000875000-memory.dmp

Filesize
2.5MB

Download
memory/5436-627-0x00007FF7EC830000-0x00007FF7EC928000-memory.dmp

Filesize
992KB

Download
memory/5436-628-0x00007FFECF570000-0x00007FFECF5A4000-memory.dmp

Filesize
208KB

Download
memory/5436-629-0x00007FFEC0320000-0x00007FFEC05D6000-memory.dmp

Filesize
2.7MB

Download
memory/5980-944-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/5980-948-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/5980-950-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/5980-956-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download
memory/5980-958-0x00007FF6FA480000-0x00007FF6FB720000-memory.dmp

Filesize
18.6MB

Download