hxxps://drive[.]google[.]com/drive/folders/1Fa0E3128_Fq0UTCtHmctLFYdK7BNsH0O

Analysis

max time kernel
1196s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1Fa0E3128_Fq0UTCtHmctLFYdK7BNsH0O

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4032	popcapgame1.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlantsVsZombies.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	popcapgame1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{85048A7F-A9DC-450F-B7B2-CB01F30C4EF0}	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3528	msedge.exe
3528	msedge.exe
2568	identity_helper.exe
2568	identity_helper.exe
5236	msedge.exe
5236	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5924	PlantsVsZombies.exe
4032	popcapgame1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1772	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3476	3528	msedge.exe	84
PID 3528 wrote to memory of 3476	3528	msedge.exe	84
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3772	3528	msedge.exe	85
PID 3528 wrote to memory of 3776	3528	msedge.exe	86
PID 3528 wrote to memory of 3776	3528	msedge.exe	86
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87
PID 3528 wrote to memory of 2180	3528	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1Fa0E3128_Fq0UTCtHmctLFYdK7BNsH0O
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fc146f8,0x7ffa1fc14708,0x7ffa1fc14718
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7929613930402604803,18395557186986394665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3124

C:\Users\Admin\Desktop\PLANT2 V2 ZOMB132\PlantsVsZombies.exe
"C:\Users\Admin\Desktop\PLANT2 V2 ZOMB132\PlantsVsZombies.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:5924
- C:\ProgramData\PopCap Games\PlantsVsZombies\popcapgame1.exe
  "C:\ProgramData\PopCap Games\PlantsVsZombies\popcapgame1.exe" -changedir="C:\Users\Admin\Desktop\PLANT2 V2 ZOMB132\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:6092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\PopCap Games\PlantsVsZombies\popcapgame1.exe

Filesize
2.9MB

MD5
c8c722b3305d66077ca44dc48e239e99

SHA1
d30a6b430dd04f8490a943c63c2db7e22f124277

SHA256
946b66d262e306b0eb26c9c165cef853155d6fd8d911c152f2a0b75a81449fb4

SHA512
42042db98197ec563a5315cdad900f832a087f37a4fff02f7c4f51cbc603f4b8e2e028cc0c9cc77df327cc2f6211da83b423cee0ed5a328e3a4370e9eda04c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
107KB

MD5
80b2d6dc17f365342a447aa431c78e19

SHA1
459a6fdbb7c98252933bc0dd27956417f4f91c67

SHA256
b9129985bfb98b4175b841e7e471577b7578954f365bc8758996ded553b20415

SHA512
d0e4495cf204f39b49527cc9f15f0983cd05ef3186f61da278fc1ebfe1d8123c0cd2c1b8ee64f2589ab8af440b030f12255c280b6b9a185b1514d6a97a32cd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
23e612ff1ef134a54b28c42be780445e

SHA1
ba98edb0104b3793319264ca7a4ef04cfcfc9b14

SHA256
d08298c30ff7091d1e84dbe3bca968d6d7edcbc22a858595fab257a898944cc7

SHA512
af66cba99d39e619f904c79d800ccb81926031b9c2574b4ce8cbc7d6e2de70a52a3f67471cc3b96cf3356f1002bb75382a99ee382636e78fcd56840ec0485479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0ff015aa2a06d15791f0d062b67aaef0

SHA1
4c779501272c3fca22ae3779a0bdfc735e985440

SHA256
e186505fe84ed7aadd5917db2c610073d26ce45e20d222d8d9f9afa30334162d

SHA512
02fbe174612e150e762a1aad11d920e94d3ca9d2bf43fc43cd921370316ad8852acb4a7f0e8e47e955f851b06b8fba1c814e372e7191ee9e4c38335880e0b944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6216f85f74bdfb7429036ba3bffa78d5

SHA1
87f835d7ed261f29df413fbc24070e432b64715c

SHA256
1c4674650d3da696397ae197d5e09417888f89ec716841dd793e2c3e6ab4611d

SHA512
30ebd2f73adb39245f231ccf3d2f628c549d77b9229cc7e84ffd65a811198f80b6614650bc35de1b9b4c5f4e5e1817b46176f9284b27f05d28cf7469c7c0ce34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
54a9e47357d898dfa70afd7989e3d8b4

SHA1
597b8e4d48bba370d717c26731ec2b87189b0445

SHA256
28d21dbec54cea08ad286ec90bfea642aa95dab3e3c75b3f5fb3d26e3cac5a4f

SHA512
385c7b3c1dd4475638339c075b8b9c8efc228abfe6ca3b3f647ff776c4827d03c99867537a7f6c4c0aca1393da24b1097b6e91c10bfff1684f6e86ac93bed73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
86473494bed0b5c113571fca294aa24a

SHA1
379b6a07acec38a46c4bf8c78207148a333e9198

SHA256
c29718216c658d0a3dccc888a1aca294280d459a7f96987efcf9fdf0fa3a9972

SHA512
953e8b7a9677e7df11de9f5c6a7522dcec9eda9588e6abff8c813e08ad364afedbd8370fb6ad8dc031deee666417c473d4d1b63d0a09f4e8b07a774039549b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
72a4ed72805c6719fdcb3d6d735dd9b3

SHA1
16d609ec727a846a7ff0d56f317c9b7dd03a1306

SHA256
e367a3e92bdaf04ce622a018a05d14063a2736a42ed86663d4ea5e42797b3669

SHA512
0494a6f7ec19da9714c1e0112d9d52085e3fe952c9c5391a52bb6128aea371e12770368baa9e95d6a251e35297591650837bfd17088c0cc5dbe6693c0232a90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
bde25f861524c30008b2c5b2c11b77ca

SHA1
a80757ee854151c0052db4731d54c0be072a3418

SHA256
89c4f1676122f3626fbf25056692acb151a8906d4eadd368e70693314f87d208

SHA512
02d23e30728ee0c146d051e9ddac95176a48c94ca69a769d616f1ae616562d825d840ce152be44c786c89e54285ad20fa14db543bcc16418138c2b77e5c5cb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ec4e33af3042cc80d7ab9d6d771ea487

SHA1
d74650d99c80b6fe585b40b7eeb5a3e42eea87e0

SHA256
ea3fdd4f286455ae9a9917236ffb0a834a27fe6e3377862e2438924abe67f3c9

SHA512
1aa68e8339a2a46b8bfc758d05ea737eb557fbe25a67d8c801e0e8cd4fde955a683fec1e63285b7f147730101acadee8f5191d7614a92d64506eef11542f09cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
df03697dd9297bc9eb1dae14ad60ea19

SHA1
a10554c813b857e2ecba09bb209f519e19fe18d6

SHA256
0058e6d56a1710f38907629cccc34220fcac7770d243240bb2b1d616d022d9eb

SHA512
d57414921c373a59a72559a17b47b592095ed614ef3fe23decda9fde0348c7b78957c34f2679366c7fccb8204b3703b820c54d9d9b6a7a8ef1305c9cff3eb1bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2280c4b579014dfaee9e0a788c44c9b0

SHA1
ae4e159378d7089f9863f5df6e572d8b64ebb80d

SHA256
7a4a8d0901dea4155d434848205d661e2fec1fb59b9a34c2c5d2bd27a038e09f

SHA512
1a4fc3e0c1b511d78c74df18267bb351d9c96bccdce64558938514e8c4ac851bfa5fa092fa3b13fd60a00aa772a81b94c89710239cdc55645d55cee055497465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
316481c2a316b2651929bc2ccb45d50c

SHA1
36205fc7102931565fc1020d6c06dbdb7a7111f2

SHA256
989837be873355d521f220212019789cf0f2e5b408e947bb9ca8fcd3edee26bc

SHA512
5dcad27b6827380bf6ff2d064dc2c378dabb20cb7aff85a9ea760e6fe14ba5b642bed1fbf57eaae22b9a95a93b8b0392f4094dd3c68b89650b6359f16c4470b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d88dd849243a9bb3b2ec76f151108bfb

SHA1
107ada73149591f1f634be57748045a147a43e0e

SHA256
78bc354ee84d5cdf0f1ab50d4072885dc46f190deffb3df3cb01fab6a029d542

SHA512
1e13bdfdb76ea152e446de01f70612e85a1be87544edb025afb6017be40dee678e50a080f8f5c1688c15d3a60b8366196a19aed8601e5f3b231ef6873366413d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e0737e857c86abbf2b1d9d600aaf37f5

SHA1
a5f52b808a66aa8851c00053f5de738c6d9f593c

SHA256
e26f2c541e2e1320628b4937bd5574422e1fcbdcae61245cf0a4c482558ecd33

SHA512
ea840dcf6c3d01ba0dc9698a4d37633c0ab8efca0c5d48847773258c5fafaa4997b211df1700de7c3169c96c91fe03aeb81ada54e5cd33ca1dced8ced25da233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e9ed0dcb90a506a8ec3a6b6ddf906e7a

SHA1
5dd69308baf0f1bac29601e75a79f0acca4d9284

SHA256
a36efb775579abbd924dd9d4e356562b2178e178b2f001e4edd163b4cee707d9

SHA512
225daed57b27637e5908af77525fab67f7e5b2949430fa0e6ee64a15fc7747cb6ae1e544f060930edc01af20fd5e7f82273572eb2f87fb04c798637053792431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d0688a44ee2c9d784976bcaa3a3f69e3

SHA1
11f6885a25865416d61b6ffa4b1fa3683ac8bd12

SHA256
dd2ccbd2be6e311a1a32527d678ccb537ed266cd9fa1fe88c6ebb1a45608064e

SHA512
dd6dec6e0f802790c5500410bcf7e80fb4f390b752d680d106ba1b045759d115a5438156d362ad2f8eee8fa60c44e4a2ae180d08128c0a1aaaf4757e1f722214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74c637964970867065f606ba5ad476b0

SHA1
3346250be488a0b9b90c94d3a40c5480cd09ded5

SHA256
932c5cf7151b80be594d6e367605a756063692b3fab0e1750533c86dea36a0e0

SHA512
400226356f5ce6c043d07d56efd595571104ebd4d33774e05ed189272bea96800de70980c51b3fba42dcb32ad55cfecbbbd3b97192e646ac7859bccb8fa18997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99c0fc18e774028ef86a2c04b983e2ae

SHA1
8f1f0a1728fa432982690be26e2535f54fe098a4

SHA256
694efd88ca46c343ea9a0ccfe9862d81f0ce94b0e1e0bc8d2738cd9bb1f2ee1c

SHA512
a194c505bbc91c9ae5f6bf23d7e1aeca7f8147e5c47872fbf737ed54b03682d9be6bf351ab6935103729037f5840176f8d3cd98e5f09e56e40c4e23a867c68d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21b6f60e719e341048ddb28f60ccf8af

SHA1
4ae1eddef15da0120e9e86f3c8d226f7f7d9b835

SHA256
f4afeefb76c4ff1c1ad2336fba15d79060dadf4d0bb1f91ec7edb49ebd4a708a

SHA512
17a4aea11b6c892e7ec9a18af54ca86b546c325394a4628ab6ee6a1bf98e93d752a68e00dfef5bc975c91a50de145199e2983ee2c3c1f0eb8f0c5ebf0cdb933d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44fbf2c8d893fd125f625241e98d3379

SHA1
4ecc6f547af98270a2ab9e18f73cd9068f63c599

SHA256
4e07238448f11b21a4f79a5d2120a87a0a188fb4efbd93cb9e66ce3a4c138bcd

SHA512
aa8f7e7c2b311e0e8f554b16558f14140968a70bf2bde272ab4cdb61349de867a1c090ebad2efffeee53ff9a2e1cfa535a37bcdf95a24da3aad4c0cf866ee496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4c4773007dfa1e726f624f89e2087d0

SHA1
89ee465e1538e26fb9d55947793e2f4f1463544d

SHA256
d13562ee85f8580f161f6e1369f47e1d5b109dc14629000ec0226dd93b71d71c

SHA512
1c466aa88caf81ba40b53ac9157ed7130de3fcd2da28cd15e118fadce322f67823bde98b682b73d246b3da9af271666e6937c505bb3f7441558c8bf2749fb288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ef89714f21f32dd816e131258f4cc079

SHA1
3674c91cafed6066b241ee61936b7e669ef21cee

SHA256
1ef0d0e24768aa66753bd8918d214e8885d397d7806a11887d39c14d2e54607c

SHA512
4297f8c6be0276b7649c288e1714d6a3a2aa9831ac4af6fff8659906af56df26780379f17a3e221b9b48b14fabfac3b3236efccfe3c7d719a77d4d5d81d9fe4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b156e9e6d6f672bd5ba380e87e4fa28

SHA1
d86a3f2d207d205f7a3260299f2315ce18ec4119

SHA256
cdd322c850eb5a965ca2bb730adb51badcbf5e7129529e9630730810831d78e1

SHA512
4fafa79374b93ec8c76f510230db3f796c7defc5f95da685742429dc4eafb622586e27798634ba60fbff217bd9989ee688a3661adee17b1a52e957a721f82bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
472df66160d6ebfbc987f58af9a6e718

SHA1
2a2a7cb8da0e1b4ba2c6c96659b234ee924b3d9c

SHA256
7cd59876a019dc02a4fc166555a4ffe3d330aa0e44c21e290be0a1d722088100

SHA512
3b041ac42c7d1067c956641aa92c84563773b87e2086cd8bb1d08ca7ee52af0355f11808bac22832e2516aef24f829f68923d5e9309bf4d4c7a5b126bea5563a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7fba3eda580b712c41e48b1c76b735a

SHA1
141ba7cb56cdd1bc3d5c7424302ec741c8509759

SHA256
4c817c9620ae00cf613b5996bae26437b5eecd606c221ebc025d95611d7ee321

SHA512
c7da01d4f688433fe56dddbcfedb3e806c7c63f5e896933e40b82e664e83d0979c44f4ee7fd8e75c5ccf83c949e031173fb56a2abec719a935190277db251995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce31aab511d19932fe649f09a376fb4f

SHA1
903057e1b10c0b65a2a96f4f13e21db52991d7d0

SHA256
2fb5d947ab2d470cf642ad776c250d5fe61cf2e2eb296aea71b81b557aca33f0

SHA512
d71ee440aae35661dd73b19d6a5c60dc54fcb2f7fbc6fb3d42d8de3f6ceb2a5c2f94fb4d93aabdd3ed2015eaf83a0584a674711a3041a2780d192f3a45c34c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
844b0a877c4f3eff3db31d5f191d38f3

SHA1
d84e864a4769fcf4f992a6f2209bc86ffcd98827

SHA256
e43544d218d23c176fda05210de6721a2ce87428b27cfb8d84f40532d3d62656

SHA512
360a327dd1c4d1edca3649f5c5a75da87e0a487b907408940587504a65f5ad16fd139ce2ae168bf5a4a369abec0ace6e09265084767d8ce1845da762b734182e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d67a.TMP

Filesize
874B

MD5
0f6764794c83ee5b007d19f034b9df83

SHA1
206ce0b4cb06e5acb0a494419e00ca612c25f48d

SHA256
90df2c2c002b191862383e4d471cbf5819ba5cf97d40c80ac4035d07f32925fe

SHA512
6d776dac1fd1d09b5e9598f6bfd63b59bfd4f3ce6bc518636eba5bd44ccdfd46e5b2d4a3d62f4359e4a67f2d1ab611370a3ccdec196b068965f87ed58a8d0c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
23085eabc776c97f355786f78d140eeb

SHA1
d12919a7572e07ec8e91aa9f2e4ea8b052cdf7cd

SHA256
f959cbf00e3ddbb320f20e50dcf2551d1195da04fd6270593ccaddb772b504d6

SHA512
a9e51f9aebba1fbc8dd01216d27818b3b626dede81b6dd769dee6be1825a9e7bfad2103b8184f8d880cdb8601997f7513a64de7dc138c430bbd004b89cb6cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
55157708cc2e3ce6fb26620c4a034226

SHA1
e4910d1e5e20e3590a8509bc8693c10ca0f5a176

SHA256
d07b1810a0d2be2f473119e0d332158d42af60276f3e4e673be6fe643ab99d53

SHA512
945ea9bd329443ab326f58b8b052c2c775bdcc30a4d7661d625edf03fe2846d09a0010b3571f92aa4beed0c7bff5e2aabea11a65e585cd95349ab619d30c2c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b6ba2b0189440896869e31dd2481934a

SHA1
d051f674e3660887ba64c1cc1194e7a2a6b2526b

SHA256
a457f514654151b9043037bb9fd0161a6fc4a786d02b9371233e7faeab44513f

SHA512
c2672fd235e5e874a9cdb9dda0f3cd768a27d38b615072ac31c7b993ec0d2663a0811131bc17774c847d264e3dee3f66903eda0ff562f796c39bfdbc4bc016c5

Download Submit
C:\Users\Admin\Downloads\PLANT2 V2 ZOMB132-20241101T064828Z-001.zip

Filesize
49.1MB

MD5
0f65de87a4b35cce577cc5383a3a95ad

SHA1
b800546d4e2f137f20d273b355c92199ac487025

SHA256
4dfa7271e72b650d9602a8adc3810c7b7ce7dbabf3fe1d6ac8af5ac3eebb9cb7

SHA512
c9cf8b3bc9aaf1d51f80fba782e738a7a6c4e6dd217e61818b0ed7ed9605fa46b39dacf2b87d0b3cc06723d9073900cb84e239854890e5e69e6fbadac078ea85

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/4032-721-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-748-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-699-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-688-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-711-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-710-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-713-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-712-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-715-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-714-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-717-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-716-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-719-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-718-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-689-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-720-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-723-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-722-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-675-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-734-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-733-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-736-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-735-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-738-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-737-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-740-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-739-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-742-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-741-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-744-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-743-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-746-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-745-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-700-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-747-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-750-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-749-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-752-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-751-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-754-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-753-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-756-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-755-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-758-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-757-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-760-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-759-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-762-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-761-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-764-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-763-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-766-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-765-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-676-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-777-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-776-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-779-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-778-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-781-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-780-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-671-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-672-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-667-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-666-0x0000000000400000-0x0000000000795000-memory.dmp

Filesize
3.6MB

Download
memory/4032-656-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-465-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download
memory/4032-464-0x0000000007D70000-0x0000000007DB1000-memory.dmp

Filesize
260KB

Download