snakekeylogger | 477c194d28848fc694b23c8074569d3028502f2e87bc92b103ae63cf795f551a

Resubmissions

04-10-2024 11:27

241004-nkmj9awala 10

04-10-2024 11:23

241004-nhfnxs1drj 10

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malw.exe
Size

715KB
MD5

8ea1822769d934de6294df2f28b58d21
SHA1

19828a1388a095de254d29c38295197462eed679
SHA256

477c194d28848fc694b23c8074569d3028502f2e87bc92b103ae63cf795f551a
SHA512

67bd5fd7a9e50775c80f8598e21fca6b767a580ad0f1d553885f39b1a79365168b0cc2d35d545878f808ea124b4cdbe0a78cc28afdd1ecddd766fb40d9fba7cf
SSDEEP

12288:4Tv8CCDmr86qJEqwz6WOfZj1cLvmj+hhV1BUwngO:Uv8Lqv8cLvJhhV1B3ng

Score

10^/10

snakekeylogger collection discovery execution keylogger spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2400-24-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4760	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	malw.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	malw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	malw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	malw.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 2400	1912	malw.exe	92

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	malw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	malw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	taskmgr.exe

Runs regedit.exe 1 IoCs

pid	Process
1616	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
1912	malw.exe
2012	taskmgr.exe
2012	taskmgr.exe
1912	malw.exe
1912	malw.exe
1912	malw.exe
2400	malw.exe
4760	powershell.exe
4760	powershell.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2400	malw.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1616	regedit.exe
2012	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
968	chrome.exe
968	chrome.exe
968	chrome.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	taskmgr.exe
Token: SeSystemProfilePrivilege	2012	taskmgr.exe
Token: SeCreateGlobalPrivilege	2012	taskmgr.exe
Token: SeDebugPrivilege	1912	malw.exe
Token: SeDebugPrivilege	2400	malw.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: 33	2012	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2012	taskmgr.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe
Token: SeShutdownPrivilege	968	chrome.exe
Token: SeCreatePagefilePrivilege	968	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 4760	1912	malw.exe	89
PID 1912 wrote to memory of 4760	1912	malw.exe	89
PID 1912 wrote to memory of 4760	1912	malw.exe	89
PID 1912 wrote to memory of 2372	1912	malw.exe	91
PID 1912 wrote to memory of 2372	1912	malw.exe	91
PID 1912 wrote to memory of 2372	1912	malw.exe	91
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1912 wrote to memory of 2400	1912	malw.exe	92
PID 1876 wrote to memory of 824	1876	msedge.exe	108
PID 1876 wrote to memory of 824	1876	msedge.exe	108
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 3480	1876	msedge.exe	109
PID 1876 wrote to memory of 772	1876	msedge.exe	110
PID 1876 wrote to memory of 772	1876	msedge.exe	110
PID 1876 wrote to memory of 832	1876	msedge.exe	111
PID 1876 wrote to memory of 832	1876	msedge.exe	111
PID 1876 wrote to memory of 832	1876	msedge.exe	111
PID 1876 wrote to memory of 832	1876	msedge.exe	111
PID 1876 wrote to memory of 832	1876	msedge.exe	111
PID 1876 wrote to memory of 832	1876	msedge.exe	111

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	malw.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	malw.exe

C:\Users\Admin\AppData\Local\Temp\malw.exe
"C:\Users\Admin\AppData\Local\Temp\malw.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\malw.exe
  "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\malw.exe
  "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2400

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:472

C:\Windows\System32\rdvidg.exe
"C:\Windows\System32\rdvidg.exe"
1⤵
PID:4476

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe1ba046f8,0x7ffe1ba04708,0x7ffe1ba04718
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12067662015000170513,8481187369798815760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe0be2cc40,0x7ffe0be2cc4c,0x7ffe0be2cc58
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1968,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1976 /prefetch:3
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2284 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3308,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3756,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4528,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4568,i,12932589638146472329,12399868753045163495,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:5212

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
81f57416c31731e82066deaaab8de716

SHA1
1be34e93998a53dcbf2ec6e5e47e0d2bc8c182da

SHA256
da61b7fab503096e63fcb702614e2573112a4df3832adf98e1ce0008a5eb3de9

SHA512
9fed520e5ef6dc233b19d6f6d29727d97b14e7c1c1b9e0be3a26c91668df7daa5c3f09d3902c6bbf8779495092f98afc81a8298a0106dbb15878f0001e46d108

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dbe19ffadf6b0b573e4d1d09e3830493

SHA1
e4b68921ccadaacf3207ba819b7c855e0818783f

SHA256
7c64ebeb0a43e18be75bbe240fdcd1203424e0c894f653da54b9c3879df7ab81

SHA512
b2a009cfaa4b06600c0abf1584eb9ae271636ecf0eec0a6a1e50fb3eeb3cd76b82653c98af30a0dfdc7628ef143c19def07ea242d406b288265a7dee324e7e33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
17d8ff628be0bc2253d9504fb86bb1b9

SHA1
03bf7c0ba57c8ecc6a0dbdd94c312ed6004c9f4a

SHA256
17908306a4d308474a180cdd59959228d1b2c72f7010470965db8a7a885a228a

SHA512
96665c80ca61b9a436deabfb1d74ce3100ad4de52186e0d1b936a901a21799ae85ac48838d0241c85ff43d5ea6712eeac9a3c87f2b0196bbabff4475cc1af6d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
b26816bdff8f3bd7884e6e521d7e0b74

SHA1
e02e0ed5d4779fcda079dfec3a8e50910e5ab4c5

SHA256
b1fcdbbbe833fbc736291a942ec28c51b2d5cdbffa4f16210c9095014d0beb75

SHA512
883761c7fc0829c89e373a8d527543da1c282d5e91827dab1819ce67fa7b611862db26b566025c0a1ef8a56c3eb17113f612ed522d1c8d5bcb30c1e738c24a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2b6257f0936e7bde9fecdf39347861d

SHA1
276826b49d14ee987068297f0ceb67d4a549851c

SHA256
1bb563884b97ec0ef0cb49a2a486a0f68f8f8f7864c3d00bb373725663ff30ac

SHA512
58d504b38553e1a5a7da2c5640b14dc61f4d2453dc4b86cb9570ac088724befc71e9daac6c41e30dcd3c035f4bd2edfc2442e1ad8f34e5df30c89d19cf7afaae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecd792faf39b9011a2c7aaca4ccf6888

SHA1
32f179cc57464bf7ca3848c706cd97cd7b7110c2

SHA256
ed1d63cf9cae2d91fcfae79c2e7f66c0440fa40d6cd5bc28546dc5cbad0bd29c

SHA512
49e7153b087493242e63c10a5377abe4acfa281434a1daefd661652abde07f82c68fa78ea6ba3e0b86bbb7a58a91367263bf545cd33cd9eb116cf08b5a76d980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c1a9a0263a9a9474993957d01d8f983

SHA1
10aa17750fb1e29a8117af51dd1c09ed7a4746c8

SHA256
e1b734856d832bdee10291ca4ba124059a2d7cdc3b40f4795e55b9f95ec96fc8

SHA512
20dbec0cac9de46fa0f197327640177475d6d55c6ec86967d7de02dea77ab445eea1ad3fa0be0e7d2930523d5f1c42bc71bc221b0cdf86c54ed8893c182e21e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4140acff342d842257e50bb503ff84bc

SHA1
74b305cb0a53ccd0d716ffe4f956de8013bac03f

SHA256
503821ca65606032ab0825bddfd1a6219383850eeb519f1ab9b69d2a8b7dee02

SHA512
c9629ec18647e6194eb30958cd38f59828e7d021fe24475f728bf997d99d63464ae803b80bf5003f61e3c1df0b7b0649dcc3f74e4f83ceded02d11d3188d9f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d440a39dd51f2a52a305ae171acb40b

SHA1
3a7fdab9ef5479e2d6254cc00f6b7022b25dd0f7

SHA256
d4219514b0d2334d24af3dad3e454e69f0b0f5fcd4bbaf79785e811d962a0145

SHA512
dcea041068b67f7d1e4138df6e63dc963187f522e601503ae51dc93e8d6229d8558261391e27ba25dccb6cabdfdb7757cf69da9d76fd9265f778cdcdce7baaeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fckxikfg.xbw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1912-21-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/1912-6-0x0000000005700000-0x000000000571E000-memory.dmp

Filesize
120KB

Download
memory/1912-0-0x000000007487E000-0x000000007487F000-memory.dmp

Filesize
4KB

Download
memory/1912-22-0x0000000002DB0000-0x0000000002E18000-memory.dmp

Filesize
416KB

Download
memory/1912-23-0x000000000C160000-0x000000000C1FC000-memory.dmp

Filesize
624KB

Download
memory/1912-1-0x0000000000A20000-0x0000000000AD8000-memory.dmp

Filesize
736KB

Download
memory/1912-26-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/1912-2-0x0000000005AC0000-0x0000000006064000-memory.dmp

Filesize
5.6MB

Download
memory/1912-3-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/1912-4-0x00000000054D0000-0x00000000054DA000-memory.dmp

Filesize
40KB

Download
memory/1912-5-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/1912-20-0x000000007487E000-0x000000007487F000-memory.dmp

Filesize
4KB

Download
memory/2012-14-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-9-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-8-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-7-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-19-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-18-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-17-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-16-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-15-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2012-13-0x0000015E4C290000-0x0000015E4C291000-memory.dmp

Filesize
4KB

Download
memory/2400-69-0x0000000006500000-0x00000000066C2000-memory.dmp

Filesize
1.8MB

Download
memory/2400-68-0x00000000062E0000-0x0000000006330000-memory.dmp

Filesize
320KB

Download
memory/2400-24-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4760-56-0x0000000006DA0000-0x0000000006E43000-memory.dmp

Filesize
652KB

Download
memory/4760-44-0x0000000006180000-0x00000000061B2000-memory.dmp

Filesize
200KB

Download
memory/4760-64-0x0000000007220000-0x000000000723A000-memory.dmp

Filesize
104KB

Download
memory/4760-65-0x0000000007200000-0x0000000007208000-memory.dmp

Filesize
32KB

Download
memory/4760-62-0x0000000007110000-0x000000000711E000-memory.dmp

Filesize
56KB

Download
memory/4760-59-0x0000000006F50000-0x0000000006F5A000-memory.dmp

Filesize
40KB

Download
memory/4760-58-0x0000000006EE0000-0x0000000006EFA000-memory.dmp

Filesize
104KB

Download
memory/4760-57-0x0000000007520000-0x0000000007B9A000-memory.dmp

Filesize
6.5MB

Download
memory/4760-60-0x0000000007160000-0x00000000071F6000-memory.dmp

Filesize
600KB

Download
memory/4760-55-0x0000000006D70000-0x0000000006D8E000-memory.dmp

Filesize
120KB

Download
memory/4760-45-0x00000000702A0000-0x00000000702EC000-memory.dmp

Filesize
304KB

Download
memory/4760-63-0x0000000007120000-0x0000000007134000-memory.dmp

Filesize
80KB

Download
memory/4760-43-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

Filesize
304KB

Download
memory/4760-42-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Filesize
120KB

Download
memory/4760-41-0x00000000055D0000-0x0000000005924000-memory.dmp

Filesize
3.3MB

Download
memory/4760-31-0x0000000004E60000-0x0000000004EC6000-memory.dmp

Filesize
408KB

Download
memory/4760-30-0x0000000004C80000-0x0000000004CE6000-memory.dmp

Filesize
408KB

Download
memory/4760-29-0x0000000004AE0000-0x0000000004B02000-memory.dmp

Filesize
136KB

Download
memory/4760-28-0x0000000004F60000-0x0000000005588000-memory.dmp

Filesize
6.2MB

Download
memory/4760-27-0x00000000022E0000-0x0000000002316000-memory.dmp

Filesize
216KB

Download
memory/4760-61-0x00000000070E0000-0x00000000070F1000-memory.dmp

Filesize
68KB

Download