rhadamanthys | hxxps://mega[.]nz/file/3zAyjSwL#undefined

Resubmissions

11-10-2024 17:59

241011-wk7jesvhje 1

11-10-2024 17:33

241011-v4vtaszakr 10

Analysis

max time kernel
277s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/3zAyjSwL#undefined

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://185.184.26.10:4928/e4eb12414c95175ccfd/Other_5

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4444 created 2780	4444	MSBuild.exe	49
PID 2200 created 2780	2200	RegAsm.exe	49
PID 1604 created 2780	1604	RegAsm.exe	49

Executes dropped EXE 3 IoCs

pid	Process
3812	App_Installer.exe
2512	App_Installer.exe
2304	App_Installer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
95	bitbucket.org
96	bitbucket.org
101	bitbucket.org
103	bitbucket.org

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell32.dll	App_Installer.exe
File created	C:\Windows\SysWOW64\temp.000	App_Installer.exe
File opened for modification	C:\Windows\SysWOW64\shell32.dll	App_Installer.exe
File created	C:\Windows\SysWOW64\temp.000	App_Installer.exe
File opened for modification	C:\Windows\SysWOW64\shell32.dll	App_Installer.exe
File created	C:\Windows\SysWOW64\temp.000	App_Installer.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3812 set thread context of 4444	3812	App_Installer.exe	122
PID 2512 set thread context of 2200	2512	App_Installer.exe	130
PID 2304 set thread context of 1604	2304	App_Installer.exe	137

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3924	4444	WerFault.exe	122
2336	4444	WerFault.exe	122
4500	2200	WerFault.exe	130
3692	2200	WerFault.exe	130
3260	1604	WerFault.exe	137
2916	1604	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
4616	msedge.exe
4616	msedge.exe
884	identity_helper.exe
884	identity_helper.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
3368	msedge.exe
3368	msedge.exe
4444	MSBuild.exe
4444	MSBuild.exe
4464	openwith.exe
4464	openwith.exe
4464	openwith.exe
4464	openwith.exe
2200	RegAsm.exe
2200	RegAsm.exe
2348	openwith.exe
2348	openwith.exe
2348	openwith.exe
2348	openwith.exe
1604	RegAsm.exe
1604	RegAsm.exe
2344	openwith.exe
2344	openwith.exe
2344	openwith.exe
2344	openwith.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2144	OpenWith.exe
1036	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: 33	4424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4424	AUDIODG.EXE
Token: SeRestorePrivilege	3984	7zG.exe
Token: 35	3984	7zG.exe
Token: SeSecurityPrivilege	3984	7zG.exe
Token: SeSecurityPrivilege	3984	7zG.exe
Token: SeRestorePrivilege	1036	7zFM.exe
Token: 35	1036	7zFM.exe
Token: SeSecurityPrivilege	1036	7zFM.exe
Token: SeShutdownPrivilege	3812	App_Installer.exe
Token: SeCreatePagefilePrivilege	3812	App_Installer.exe
Token: SeShutdownPrivilege	3812	App_Installer.exe
Token: SeCreatePagefilePrivilege	3812	App_Installer.exe
Token: SeShutdownPrivilege	3812	App_Installer.exe
Token: SeCreatePagefilePrivilege	3812	App_Installer.exe
Token: SeShutdownPrivilege	3812	App_Installer.exe
Token: SeCreatePagefilePrivilege	3812	App_Installer.exe
Token: SeShutdownPrivilege	3812	App_Installer.exe
Token: SeCreatePagefilePrivilege	3812	App_Installer.exe
Token: SeShutdownPrivilege	3812	App_Installer.exe
Token: SeCreatePagefilePrivilege	3812	App_Installer.exe
Token: SeShutdownPrivilege	2512	App_Installer.exe
Token: SeCreatePagefilePrivilege	2512	App_Installer.exe
Token: SeShutdownPrivilege	2512	App_Installer.exe
Token: SeCreatePagefilePrivilege	2512	App_Installer.exe
Token: SeShutdownPrivilege	2512	App_Installer.exe
Token: SeCreatePagefilePrivilege	2512	App_Installer.exe
Token: SeShutdownPrivilege	2512	App_Installer.exe
Token: SeCreatePagefilePrivilege	2512	App_Installer.exe
Token: SeShutdownPrivilege	2512	App_Installer.exe
Token: SeCreatePagefilePrivilege	2512	App_Installer.exe
Token: SeShutdownPrivilege	2512	App_Installer.exe
Token: SeCreatePagefilePrivilege	2512	App_Installer.exe
Token: SeShutdownPrivilege	2304	App_Installer.exe
Token: SeCreatePagefilePrivilege	2304	App_Installer.exe
Token: SeShutdownPrivilege	2304	App_Installer.exe
Token: SeCreatePagefilePrivilege	2304	App_Installer.exe
Token: SeShutdownPrivilege	2304	App_Installer.exe
Token: SeCreatePagefilePrivilege	2304	App_Installer.exe
Token: SeShutdownPrivilege	2304	App_Installer.exe
Token: SeCreatePagefilePrivilege	2304	App_Installer.exe
Token: SeShutdownPrivilege	2304	App_Installer.exe
Token: SeCreatePagefilePrivilege	2304	App_Installer.exe
Token: SeShutdownPrivilege	2304	App_Installer.exe
Token: SeCreatePagefilePrivilege	2304	App_Installer.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
3984	7zG.exe
1036	7zFM.exe
1036	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe
2144	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 548	4616	msedge.exe	83
PID 4616 wrote to memory of 548	4616	msedge.exe	83
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 3380	4616	msedge.exe	84
PID 4616 wrote to memory of 64	4616	msedge.exe	85
PID 4616 wrote to memory of 64	4616	msedge.exe	85
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86
PID 4616 wrote to memory of 2316	4616	msedge.exe	86

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2780
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/3zAyjSwL#undefined
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef7e246f8,0x7ffef7e24708,0x7ffef7e24718
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,8691996158393032902,15389148136846559501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4bc 0x424
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2268

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap16041:90:7zEvent701
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3984

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\AppSetup(Full).rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1036

C:\Users\Admin\Desktop\App_Installer.exe
"C:\Users\Admin\Desktop\App_Installer.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 464
    3⤵
    - Program crash
    PID:3924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 460
    3⤵
    - Program crash
    PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4444 -ip 4444
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4444 -ip 4444
1⤵
PID:5072

C:\Users\Admin\Desktop\App_Installer.exe
"C:\Users\Admin\Desktop\App_Installer.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 592
    3⤵
    - Program crash
    PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 588
    3⤵
    - Program crash
    PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2200 -ip 2200
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2200 -ip 2200
1⤵
PID:3928

C:\Users\Admin\Desktop\App_Installer.exe
"C:\Users\Admin\Desktop\App_Installer.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 592
    3⤵
    - Program crash
    PID:3260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 588
    3⤵
    - Program crash
    PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1604 -ip 1604
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1604 -ip 1604
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4D1ED785E3365DE6C966A82E99CCE8EA_4FF21E9CE9761A304E66D2F0263F90A7

Filesize
471B

MD5
b220f29f715fe7e09a71b9cd26a1779b

SHA1
0c061a16f30602ac962e039a7f58fbb977fe8f77

SHA256
bde9c227d43f1feccea1a3fdfea0d73531d6fcbd58c2dfe3ee26c484cc618c57

SHA512
0e1991287faf263e95ac7b17f6ab9fe93b849f53e7a77942b38945ed673ba6335760b960e5142958cbf834069e41f250306bf0330ea0bdf659a104f5df578560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
f5e5bddbd4398ed59d4dfe81092ee548

SHA1
388eaef35b9d706a2080b104433181a26dd97092

SHA256
decc881544bcdd373795a01ba50eb00a003f4c0c82a17f42d64be17c3da4c356

SHA512
5134db69b999df17c245179d7e43f3dfce030616877b36cc6f5eda6ea07ab6cb3dbf9d142427d3e375bc24687386283c896de91356434eb07588ac8253de7a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4D1ED785E3365DE6C966A82E99CCE8EA_4FF21E9CE9761A304E66D2F0263F90A7

Filesize
400B

MD5
e4a39d397e3767391c48f551709aafc0

SHA1
0b75e18593f1f1233efb532995557c587e6835ad

SHA256
a99592663ec6cdca4e1e85240bdecb192c6e1d4bd28f2913726a928856f35548

SHA512
5b8e452d97b18ec738c10f8eb455c5461c04be151f13c703b7fdcd74d13c2a4e8500e4411582816ae28ee770e812201552d584d0cb0b2f46040cc9e4f14bf486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
eda0dfc3b6ae0e51280c65fd1f82b3d3

SHA1
2b618cede78097afa2aeb07ff6c786f6e920d97c

SHA256
65cfa8387978cfdbb1d3206cfc715d52b18b09ce4426127dc9a879d81e006a49

SHA512
42f0e69b2941494e2d137076b4d94510da26a68a9c72e38993f11630fca2bbad4959777f8889769ec5861ef3afa9c9caa08debe17cd954721f7f68811aaed074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
00344c071f662438c5bdc947203c14a2

SHA1
ba354c2db510933a171f1092b66b261aad405793

SHA256
51829a8ec10ef3a426a02132e567dcecb6ef145551ee90fe0504161310e5dfa3

SHA512
bd4ad0140935df9359a622cfe377a43a3cb35316d765cec9333e647367f271a79c4587dbc8039532e3276f045baf153e62fd3d2422ea949eb9a981e526a1e514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0231b8886b202c8e73377c495e2052af

SHA1
485d40ae718695e949c237df114485f65e4ed0d9

SHA256
cbee4636d506e1939d4beb9c6829266f956d662053f70a265034014695e26403

SHA512
c8e1c915b067b128734f5d6debda6eecf6be93ec065bcbbed7ac2f51c0a2334967937b95ea630d14713d6442a2187a74d1844967bc449138be503ed881733cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c37bc8d5b1c692aa1a328f93b80434cd

SHA1
394a413591651a5804304574dae07b2ceb9bf643

SHA256
f2733b67873e7da64c7db024d6fc8edbfd68cca188312cede8663495d690cc23

SHA512
fca08db8d2418750a5d79de8c8f26b1b8d9266c1b74b59e059e88347fd6b33c7ce76c0724b18ede8c0d8ceb88c2eda15a7eea62a3029adf34fb6aabf17e0a2fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9233c237c2fb32ca00625042c90dcf90

SHA1
6132c51a20af3344465942e76c2efdd2942bfc82

SHA256
112ea462b0719e9505bfbadd85ebbb12d9641feb77d3d5a4be27207a49d8ae69

SHA512
8639b03bbecdcd2f1b20fbf22e8d59af36465f0212f8eaff81c06911ad3d3dc197a38d0598564aadee3a8501f6a7ce6259443383bc88de3b1f94f0191b99ec2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db80189b95cb1b674d0082622d315d71

SHA1
ca39eeab58925a4e849db94a845000006f207e14

SHA256
b6bec1cee0e8d1c38516bc275621a4daf9942e05eb3a74635596ce87c22bae69

SHA512
e235aa15fc547fa22bc6d1ebc89e72c782f3073cbbe5e354655239aa341361d9a490f114dff94ab98203e0e5656d3b353cc6ec03f4246a7a26ad056bf8c75edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f383821ca65bcbb75aedea4bf5b2704d

SHA1
474cfafc802d0e833dde26abad634f5f4ed08d29

SHA256
00f68023ed0d3a0b65bf834e1703d4ba3e959ffe8657e34461eadbd5d55f3bee

SHA512
6966d10fcdf14b024ec29d10e9781f903f24f4dcf471a47fc625fdcfd41ea26f0e5c5567d723905052edbc8f5673fd6a397a3132f900eeb4e44edfc8d77160f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c498.TMP

Filesize
48B

MD5
d685029658d331b5403809351b009d45

SHA1
3e745b4b4cfc1877428339493261a0598e69bca1

SHA256
c5f9e8543d06f61c677ea02a4f2643d17de1e7a31ab540e2dada214e7ceb6091

SHA512
3af79aaf36f660eff00665ccdd4794caf563621f0248f6a6f8e83657a413ba3e7112c5ae9d86b40b86c7b4476ab41af232157c4a46a931b2e3c20e45ea5f9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9ebf49b3df409b509b92644538d4b6b3

SHA1
93ad30c94459c709e3d56de8f8fdad91d959a5b9

SHA256
41c5a1968d389a301e33b8990ad129b579bac8f9b200ca6921ca14c42dde2d82

SHA512
f78118d09850281d4983a062db9562f5cb6f7d891f3a4104ada3633c512913e78998af136fb549ff8fe23ec2e9ede6de9b24ae1dc4aa0c82bda92413fd9faa61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
44aea976cc1cf9e13515e947ead3ce49

SHA1
c5956bc7eee04d7464b8ff4179237986fb7614d4

SHA256
3f8edcc439c7d7a6c18e6df5fb0c3a5e8924fd2618bd048e29768014210d3cac

SHA512
12e37af53d92d9db31f6d23342ed407ca2fb0cc4fe473e25f50d40617cf849edd5d28852a2696ead49c74da99fd6aac4d6c6f4fe5252fd5f252e431cb80b5154

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\SysWOW64\temp.000

Filesize
5.7MB

MD5
ed7702573c750ea627dc5f620e3b64fb

SHA1
7affe46da633cf1bbe00640c105f90bfb8af455b

SHA256
b43e03aba20516081d8a94f92381afc82f836cca08a267f9fc51345305a4dbce

SHA512
d206d094feb81186c31db9a603bf6303417e2b29082271049fa217d0a454d51dcdd3aae13b33a472663b4351ccedfccebe05c91e5d1f343cde5897d1bda6ed65

Download Submit
memory/1604-462-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/1604-461-0x0000000003A20000-0x0000000003E20000-memory.dmp

Filesize
4.0MB

Download
memory/1604-457-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1604-459-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1604-464-0x0000000076770000-0x0000000076985000-memory.dmp

Filesize
2.1MB

Download
memory/2200-444-0x0000000076770000-0x0000000076985000-memory.dmp

Filesize
2.1MB

Download
memory/2200-439-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2200-437-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2200-441-0x0000000003740000-0x0000000003B40000-memory.dmp

Filesize
4.0MB

Download
memory/2200-442-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/2344-468-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/2344-470-0x0000000076770000-0x0000000076985000-memory.dmp

Filesize
2.1MB

Download
memory/2344-467-0x0000000002D10000-0x0000000003110000-memory.dmp

Filesize
4.0MB

Download
memory/2348-448-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/2348-447-0x0000000002A80000-0x0000000002E80000-memory.dmp

Filesize
4.0MB

Download
memory/2348-450-0x0000000076770000-0x0000000076985000-memory.dmp

Filesize
2.1MB

Download
memory/4444-420-0x0000000076770000-0x0000000076985000-memory.dmp

Filesize
2.1MB

Download
memory/4444-418-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/4444-416-0x0000000003A50000-0x0000000003E50000-memory.dmp

Filesize
4.0MB

Download
memory/4444-415-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4444-414-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4444-417-0x0000000003A50000-0x0000000003E50000-memory.dmp

Filesize
4.0MB

Download
memory/4464-426-0x0000000076770000-0x0000000076985000-memory.dmp

Filesize
2.1MB

Download
memory/4464-421-0x0000000000FE0000-0x0000000000FE9000-memory.dmp

Filesize
36KB

Download
memory/4464-423-0x0000000002DD0000-0x00000000031D0000-memory.dmp

Filesize
4.0MB

Download
memory/4464-424-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download