blackguard | 8c09a321764b6ca61eafcfb69894fd80321900585fe47db6f11eb04e9401cce8

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PARANOID CHECKER V4.2.7.zip
Size

11.6MB
MD5

875849c78e1edfd95dc34028a2fb8300
SHA1

648bcd5287ee4e80b170453addfc5a2afeab0ba7
SHA256

8c09a321764b6ca61eafcfb69894fd80321900585fe47db6f11eb04e9401cce8
SHA512

0e375e44dffa6f50046cba650dc9467c5ef446042a5c1af817e8b143d57cd1b9b2bc959b04d61ed9588272306681993e0485f602bc8c1ade9094314803e570af
SSDEEP

196608:EGJNhExKiTDR6R6p1Vs4J0tgoy+k+6y51hiZz1sLt8hk9DWPnJOEIk/NxMwwNJyv:EGJNhExXfRQt4JQhYhyRewt8hk9DWxOA

Score

10^/10

blackguard discovery spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	api.ipify.org
71	api.ipify.org
36	api.ipify.org
37	api.ipify.org
39	ip-api.com
58	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paranoid Checker V4.2.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paranoid Checker V4.2.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paranoid Checker V4.2.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paranoid Checker V4.2.7.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Paranoid Checker V4.2.7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Paranoid Checker V4.2.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Paranoid Checker V4.2.7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Paranoid Checker V4.2.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Paranoid Checker V4.2.7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Paranoid Checker V4.2.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Paranoid Checker V4.2.7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Paranoid Checker V4.2.7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3720	Paranoid Checker V4.2.7.exe
3720	Paranoid Checker V4.2.7.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
1572	Paranoid Checker V4.2.7.exe
1572	Paranoid Checker V4.2.7.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
5008	msedge.exe
5008	msedge.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
5988	msedge.exe
5988	msedge.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3448	Paranoid Checker V4.2.7.exe
3448	Paranoid Checker V4.2.7.exe
3448	Paranoid Checker V4.2.7.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3720	Paranoid Checker V4.2.7.exe
Token: SeDebugPrivilege	3872	taskmgr.exe
Token: SeSystemProfilePrivilege	3872	taskmgr.exe
Token: SeCreateGlobalPrivilege	3872	taskmgr.exe
Token: SeDebugPrivilege	1572	Paranoid Checker V4.2.7.exe
Token: SeDebugPrivilege	3448	Paranoid Checker V4.2.7.exe
Token: SeDebugPrivilege	4120	Paranoid Checker V4.2.7.exe
Token: 33	3872	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3872	taskmgr.exe
Token: SeDebugPrivilege	5780	taskmgr.exe
Token: SeSystemProfilePrivilege	5780	taskmgr.exe
Token: SeCreateGlobalPrivilege	5780	taskmgr.exe
Token: 33	5780	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5780	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe
3872	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4980	2808	msedge.exe	109
PID 2808 wrote to memory of 4980	2808	msedge.exe	109
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 4964	2808	msedge.exe	110
PID 2808 wrote to memory of 5008	2808	msedge.exe	111
PID 2808 wrote to memory of 5008	2808	msedge.exe	111
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112
PID 2808 wrote to memory of 4164	2808	msedge.exe	112

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\PARANOID CHECKER V4.2.7.zip"
1⤵
PID:2280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3680

C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe
"C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3872

C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe
"C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7602f39ch092dh4612h875fhc94c28c4c2c8
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdd8cf46f8,0x7ffdd8cf4708,0x7ffdd8cf4718
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9927597019114982777,1834219294089913064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9927597019114982777,1834219294089913064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9927597019114982777,1834219294089913064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulte97be6a1h647ah4c57h8d21h8cd17cc0cdb2
1⤵
PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdd8cf46f8,0x7ffdd8cf4708,0x7ffdd8cf4718
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11123514729924588907,16293061208508792769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11123514729924588907,16293061208508792769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11123514729924588907,16293061208508792769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:6020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5216

C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe
"C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe
"C:\Users\Admin\Desktop\PARANOID CHECKER V4.2.7\Paranoid Checker V4.2.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WindowsBrandOr\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\ProgramData\WindowsBrandOr\Files\PublishResolve.png

Filesize
663KB

MD5
99470a14d94e76feea985b7844f1f76c

SHA1
e66da315bf963eaa08bd51c07750709506bf9cb8

SHA256
5007de841366a4e2508b8d6efd11827f62ba0f5fcb2ca03e4bd1560b034d6060

SHA512
26e61f0b59f25b0c4c0b7fdc6336038277f2b06a96932008078be69ae217dac56bbd9df9f6bfbfb64fc58ef6495844a9201121651347b10e12e000a5fd625a52

Download Submit
C:\ProgramData\WindowsBrandOr\Files\WatchGroup.pdf

Filesize
821KB

MD5
11f2f09108d412e51ef829219247e718

SHA1
ff9d914d44014901dfb6b5db8affb3e46e088041

SHA256
e79f5b99ddd7e24394c80dfb66652dd250f8afe5a6e2bef9d62b14008601233a

SHA512
16cc03f8d191f213df380290f997f4141284b3b568bf4b17f4b5798c762e0c3512c4059386633251c4767ae12379b7a957a35d87f1198831b024951a57a0f754

Download Submit
C:\ProgramData\WindowsBrandOr\Process.txt

Filesize
1KB

MD5
d01540f1897a01229f036f407a4eb16c

SHA1
b23e06738ccbb599d46a445192c51aa6ab5c0b29

SHA256
a4ddb67aca124e57cb0f58c2664bfa10943e5e7960f21f9686b33e7213fac0ab

SHA512
92df7961a1ed4726e3f2a2e944c5e8b5986cb0ef997b50a7103ecf6721e854dfd14331928d9bfb4d59c3a97c03afc9a237ccc00c97b2f146d2316f7288753358

Download Submit
C:\ProgramData\WindowsBrandOr\Process.txt

Filesize
735B

MD5
038c161b80ef96e3170c1e17335ac981

SHA1
708f33f1a0e5698b500d65617418d4a1a240409c

SHA256
eaf068d754c7296bce32879267ffc456c0bb3e7e083e0a2f6d136a8410d46420

SHA512
1d3a6927b20f299caad2be2e22031a9864c9b1a30a50a03144b55b3c517da849cdbef55faea63df22abae13b63d1d0b82cb8a44906a9ba5b3f5d19dfb74f2909

Download Submit
C:\ProgramData\WindowsBrandOr\Process.txt

Filesize
1KB

MD5
11174b68feb13cc8c5e13b7a624c77c5

SHA1
a7e539073598925855f84d284740739680a18471

SHA256
4e64af3fa3e31dfeee141e02aba0a790eb7396cb5e5731c0205e5e991f6d9f69

SHA512
617f5db21b37885465e9aa139757b80204daeb64aa9f2ecff656bb2d1348c47316469ed9ce51406453c7ad19e59118c81b0b622b613d1b5c7081adadf550ac00

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Paranoid Checker V4.2.7.exe.log

Filesize
1KB

MD5
ef1ebb588ad36f27a413d0c748cb5d01

SHA1
b403120e62eb4d242ed354f90e9f0ebba7fdd1ad

SHA256
167889594f7fee7222e53a117a51008e4e2036f723b98c5c3047b982e71a9614

SHA512
c84a720cf215a66b64d5233bb14a8b3cbfac40f982a6e7198007ffa40a64d61dbc117cf6808c201d6a2d104e3f0e928eef1970e84b712a47f8edd8f8309c1280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
675bd49769d63749e74805c10a929e7c

SHA1
68ae251a2aeec4c1cc3c3c8db595d1b24ac40528

SHA256
928fc6022955b97714447124b3561bb7a794da7c8bd3e3f11c45cdd4fcf7fa7f

SHA512
ec37d472f4798548c645d119bab4a71b9618474dc6ebc3d2e264ae95f25129e7d539a1a7922117aa4577a9b69d37d067dd468497b048e9beda87fa7ec76f528e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7ba0ec6f2ebe5465f1a24b535d21978

SHA1
76141c10ffa3daeb6d331ed3912abba28b92ee02

SHA256
40eccb2ad3337573ed001d53f63c58aebc2663ed3bceb09e0c05ee502c970f80

SHA512
f09e431f4e76d03e157bfbe9b45876606cff20795d4129b0c1a77a9e8fa7525c2d338de8aecc8aaeecb6daf4dfac006207879eed9061f2dcea158e3606781ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
d998a4b51e6d094347be12706824d365

SHA1
dd2c5a19e29c8dedc41798e8d3fc26243bed24a4

SHA256
84b4fc3120d78cdb45cff13598dbdbf1a4be77dccd8ba5c36b1fe077ae6b313b

SHA512
7270d1046abbd289e7ae3886e74ad6c0b882b403ea2d3ba7c1f1bf5c5a6357885f6c2ab8fc95635577dde499d0c8f5f9e3ff9375df3b1b26b2c1d705a01c7a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
540f1e63a08340592a1ec8f52554651f

SHA1
12304ae587bdad008f547ea0b171e5c5055cdc73

SHA256
c45ab7bb025ffa0fe2957304a62264c63dcf8ca72f0766dc4a96a1d0588f0ad2

SHA512
e5ea74e0d26c295be24f326a5d83641a852b5784d18ae106652a525a3fd189438fdea57cfce1dd67636303e906484d58e941c6036f58e9cfba7e21aceba3c763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6e0d22f112af4efba58172db9af459db

SHA1
74b3ecbb4f072174870dd1edcc9f24c32e63098b

SHA256
ddf1a730225067fc4748fccb24603684ceb8de3f6d434aeaa9f52cf2f7264610

SHA512
9c2ee36ec99fb5ce179c22fb2129610e6d20508820d8d154b645f1615d2091f0915e500cc943f1979d055ee2ddc546f10f90e696a49803b8f146e3d44a8fe631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4506f20cba60174f21b318af72a6b7bc

SHA1
b071427fd2b2ae72b26d56a931cde99651bffc7f

SHA256
2889f213374d4689d50379fd6b15acb4e4abc39b73276dc59f714a3b7b96eefe

SHA512
4015bc01c7f603dc87ced59baddef49e382252616db31c9fc101fbbbda8dff9a157a7039f6b68a1a520206d33242e39575aa2dc68b6123384b7e745ed2aec02a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kt4EXURahPbGEwd

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sNYniHnqo2WZHLW

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp143.tmp.tmpdb

Filesize
5.0MB

MD5
81412f7f844b75a6c65ed71eac0b9e61

SHA1
39b14eb48e13daaf94023482666fc9e13118ba72

SHA256
e37ca7753860c60248b70828432c8e018a3788479808fdfdbc4d3b369b381019

SHA512
63f2f6af6974091fb8de9dae945b392bb5f68abe66f7d9e3906089bb31f8e7ae2be03fcce44288514678b2b79eb309667b4607e9132183d1bb9a631ad65a983a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp145.tmp.dat

Filesize
114KB

MD5
242b4242b3c1119f1fb55afbbdd24105

SHA1
e1d9c1ed860b67b926fe18206038cd10f77b9c55

SHA256
2d0e57c642cc32f10e77a73015075c2d03276dd58689944b01139b2bde8a62a1

SHA512
7d1e08dc0cf5e241bcfe3be058a7879b530646726c018bc51cc4821a7a41121bcda6fbfdeeca563e3b6b5e7035bdd717781169c3fdbd2c74933390aa9450c684

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp167.tmp.dat

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6E78.tmp.tmpdb

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD1EE.tmp.dat

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD1F2.tmp.dat

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\whj0XJfU1XvrbgE

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\yCtoJWGYiVomEcQ

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBrandOr\Process.txt

Filesize
895B

MD5
9fd528b5524ca3699cd7ac8c9a49a5a8

SHA1
93d67eba46987b5165795710e869979f344f4649

SHA256
a5133ad91651ac1f2d3fd321142d6a84f6515637a4148e1afbb31cc07a8cbb11

SHA512
e1aa17a213b7f4fe11df9fe15d40bb096ef9302ea7836c1d97a232109465a8d0595acf8eb99ec2766603da59d6d0a49d5e38bcd182e3d0b315dde0f55292b529

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBrandOr\Process.txt

Filesize
1KB

MD5
f31fe885d1e9480ec80f25d1d5cdfc7c

SHA1
4c8ee428d7b0a8cebf3d9b296bd90d4cbbc39381

SHA256
f9e86fbdd13bc65439f3357e8a1e8a5b11e9f9de13b97c20e54b405faedb6203

SHA512
ff117f7bff1979a7b4a3fc8e644cf33fa6c94fe01023030f874dcf0508a057f64a3586dfc2018fd4b92cb28d26da2eaf4fd248f08405ad3bedad7a2b2132a28f

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBrandOr\Process.txt

Filesize
740B

MD5
4313e440d04b2a20f8862fcde82e8785

SHA1
59aff8ae8bc354d6b9f2eff941e0443bd1616163

SHA256
aec314a7290ccce448a7b61b432b952c14bd6c2eef1772faee4fa624afb8195f

SHA512
9f9cc10cda182e188b324b6679f9c656923ea5e85a5131b985c6d1c3257d365ad4b9672f7c2c50e032a2b693f7ced03dd0941a7ea61f919fabb63c21310f999f

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBrandOr\Process.txt

Filesize
1KB

MD5
9ec9352ef5e014c4a38dfbbffdf06ae1

SHA1
ce4c6c245ea408e5b714c55942d08db00e489415

SHA256
87a3929d824c2c37afa0e575d2fa5d0c30f520c7623626b2a3b5d09519e186b7

SHA512
e2b384bc72549bec71b7434b25272b43380f8688a8df649a2d981f6a7baf64d2b26b876e19220fca598134a2e63166f1f8eb78b5c958ed73a727c4841e928d94

Download Submit
memory/3720-1-0x00000000000E0000-0x0000000000172000-memory.dmp

Filesize
584KB

Download
memory/3720-161-0x0000000006AE0000-0x0000000006B46000-memory.dmp

Filesize
408KB

Download
memory/3720-4-0x0000000005A40000-0x0000000005AB6000-memory.dmp

Filesize
472KB

Download
memory/3720-5-0x00000000059E0000-0x00000000059FE000-memory.dmp

Filesize
120KB

Download
memory/3720-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Filesize
4KB

Download
memory/3720-2-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/3720-3-0x0000000005970000-0x00000000059C0000-memory.dmp

Filesize
320KB

Download
memory/3720-18-0x0000000005E70000-0x0000000005F02000-memory.dmp

Filesize
584KB

Download
memory/3720-19-0x00000000064C0000-0x0000000006A64000-memory.dmp

Filesize
5.6MB

Download
memory/3720-180-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/3720-163-0x00000000060C0000-0x00000000060D2000-memory.dmp

Filesize
72KB

Download
memory/3872-190-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-193-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-182-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-191-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-189-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-188-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-187-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-192-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-181-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/3872-183-0x00000254F1660000-0x00000254F1661000-memory.dmp

Filesize
4KB

Download
memory/5780-829-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-830-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-828-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-840-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-839-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-838-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-837-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-836-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download
memory/5780-835-0x0000024DA96D0000-0x0000024DA96D1000-memory.dmp

Filesize
4KB

Download