mystic | 248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malicious.exe
Size

1.8MB
MD5

18cbe55c3b28754916f1cbf4dfc95cf9
SHA1

7ccfb7678c34d6a2bedc040da04e2b5201be453b
SHA256

248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b
SHA512

e1d4a7ab164a7e4176a3e4e915480e5c60efe7680d99f0f0bcbd834a4bec1798b951c49ef5c0cca6bea3c2577b475de3c51b2ef1ae70b525d046eb06591f7110
SSDEEP

49152:Eau0Bnly1l8B6hLa5vMIKHVo5W1v2mS0la98MT:Nfy1Wo+JK19eFE6

Score

10^/10

mystic redline smokeloader frant backdoor discovery evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

frant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1932-66-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/1932-67-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/1932-69-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Mystic family
mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/3932-77-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Redline family
redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

Executes dropped EXE 8 IoCs

pid	Process
2728	Yt8ge85.exe
1408	GY4IC43.exe
2116	hE8Zq97.exe
1764	1Zn59od7.exe
768	2PO9885.exe
3920	3FD62NB.exe
540	4Ii975UD.exe
3188	5uR3lF9.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	malicious.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Yt8ge85.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	GY4IC43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hE8Zq97.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 3864	1764	1Zn59od7.exe	90
PID 768 set thread context of 1932	768	2PO9885.exe	95
PID 3920 set thread context of 3264	3920	3FD62NB.exe	99
PID 540 set thread context of 3932	540	4Ii975UD.exe	106

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4356	1764	WerFault.exe	87
4076	768	WerFault.exe	94
4808	3920	WerFault.exe	98
4820	540	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hE8Zq97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1Zn59od7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2PO9885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3FD62NB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4Ii975UD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	malicious.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5uR3lF9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GY4IC43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yt8ge85.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3864	AppLaunch.exe
3864	AppLaunch.exe
1700	msedge.exe
1700	msedge.exe
448	msedge.exe
448	msedge.exe
2164	msedge.exe
2164	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	AppLaunch.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2728	4844	malicious.exe	83
PID 4844 wrote to memory of 2728	4844	malicious.exe	83
PID 4844 wrote to memory of 2728	4844	malicious.exe	83
PID 2728 wrote to memory of 1408	2728	Yt8ge85.exe	84
PID 2728 wrote to memory of 1408	2728	Yt8ge85.exe	84
PID 2728 wrote to memory of 1408	2728	Yt8ge85.exe	84
PID 1408 wrote to memory of 2116	1408	GY4IC43.exe	86
PID 1408 wrote to memory of 2116	1408	GY4IC43.exe	86
PID 1408 wrote to memory of 2116	1408	GY4IC43.exe	86
PID 2116 wrote to memory of 1764	2116	hE8Zq97.exe	87
PID 2116 wrote to memory of 1764	2116	hE8Zq97.exe	87
PID 2116 wrote to memory of 1764	2116	hE8Zq97.exe	87
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 1764 wrote to memory of 3864	1764	1Zn59od7.exe	90
PID 2116 wrote to memory of 768	2116	hE8Zq97.exe	94
PID 2116 wrote to memory of 768	2116	hE8Zq97.exe	94
PID 2116 wrote to memory of 768	2116	hE8Zq97.exe	94
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 768 wrote to memory of 1932	768	2PO9885.exe	95
PID 1408 wrote to memory of 3920	1408	GY4IC43.exe	98
PID 1408 wrote to memory of 3920	1408	GY4IC43.exe	98
PID 1408 wrote to memory of 3920	1408	GY4IC43.exe	98
PID 3920 wrote to memory of 3264	3920	3FD62NB.exe	99
PID 3920 wrote to memory of 3264	3920	3FD62NB.exe	99
PID 3920 wrote to memory of 3264	3920	3FD62NB.exe	99
PID 3920 wrote to memory of 3264	3920	3FD62NB.exe	99
PID 3920 wrote to memory of 3264	3920	3FD62NB.exe	99
PID 3920 wrote to memory of 3264	3920	3FD62NB.exe	99
PID 2728 wrote to memory of 540	2728	Yt8ge85.exe	102
PID 2728 wrote to memory of 540	2728	Yt8ge85.exe	102
PID 2728 wrote to memory of 540	2728	Yt8ge85.exe	102
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 540 wrote to memory of 3932	540	4Ii975UD.exe	106
PID 4844 wrote to memory of 3188	4844	malicious.exe	109
PID 4844 wrote to memory of 3188	4844	malicious.exe	109
PID 4844 wrote to memory of 3188	4844	malicious.exe	109
PID 3188 wrote to memory of 1712	3188	5uR3lF9.exe	111
PID 3188 wrote to memory of 1712	3188	5uR3lF9.exe	111
PID 1712 wrote to memory of 2164	1712	cmd.exe	112
PID 1712 wrote to memory of 2164	1712	cmd.exe	112
PID 2164 wrote to memory of 964	2164	msedge.exe	115
PID 2164 wrote to memory of 964	2164	msedge.exe	115
PID 1712 wrote to memory of 1968	1712	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\malicious.exe
"C:\Users\Admin\AppData\Local\Temp\malicious.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 572
        6⤵
        Program crash
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:768
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 576
        6⤵
        Program crash
        
        PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        
        PID:3264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 600
        5⤵
        Program crash
        
        PID:4808
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 572
      4⤵
      Program crash
      PID:4820
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B229.tmp\B22A.tmp\B22B.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff81e2646f8,0x7ff81e264708,0x7ff81e264718
        5⤵
        
        PID:964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
        5⤵
        
        PID:1564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        
        PID:4612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
        5⤵
        
        PID:4036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
        5⤵
        
        PID:1936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        5⤵
        
        PID:2384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
        5⤵
        
        PID:5164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13272629138620596456,2475816139805299168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
        5⤵
        
        PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:1968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff81e2646f8,0x7ff81e264708,0x7ff81e264718
        5⤵
        
        PID:3576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2067939068923440832,8058145803355303321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        5⤵
        
        PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2067939068923440832,8058145803355303321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1764 -ip 1764
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 768 -ip 768
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3920 -ip 3920
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 540 -ip 540
1⤵
PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e4b402aa172d2c06e7da46f348f9843c

SHA1
c8c32abfed8f137d81336100fef9291ff5fc3948

SHA256
7cb34ad18e8ddf2fe1264cafa7825cb46c65bf146207fc4977ba60ea54b514b7

SHA512
e30a792968b245a71a9e8ad3bee96d60aaad2b3665c7b58a70c71c0bd251fe0807acdc65f1476892ac1763ef94e6c674f6039def69dc9314779309fd81a64db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b9d07c29e256f4bc6b0738dbeaa782e5

SHA1
742f68f53c22472c6103fae3a7548ffe71a8a920

SHA256
c6898140d5aeb47639d75974556cc9cfb52efd06c6bd6bb2ac890ef611e7af0e

SHA512
6b0d707d2f8d9e015d8df39d87720088715e1ec2ac5de981fd891563f99c8b7b0dbc637a41c1d698fd19e0dd4cbb22b50009fb6709e8f90ce4044084aef138e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8bfebc5aca77210895332891cf48836d

SHA1
067b81e027fba7c6fe7d1526638fec1d999937be

SHA256
768be5208f868f08aa929aa3a70751e38e20081f46d846da18244c728ce349fa

SHA512
74ecbf2e56ce46f60555f62cce70de1b66d5553c75c37ac1b06dbf826d623a704c2ea1534548448f2a7e20d780e81617d2f4580888783592dbfffbeff9e9f7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5776ed48acb85e4f4aeb9059fa639768

SHA1
b14cfd625be0ef77f1de78cd50fac4a3a3ec13d5

SHA256
9a6ad255dc7d8d0b7d31f4cd151c717f23583cb3672986937822bc5a3af1f010

SHA512
d8bd7f80a343fec81d329de7de66ac3dd6a8060574121ee5afe32f12bd26f816b36c3700d6c5613a9c7282c007c0cb6d54cdb748f4a47aa101de2bf8abea0ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf501e5dc85b7e66986bef652c95d047

SHA1
ee1f1687b3b09db18b0b578c1b1756c34881ba61

SHA256
f63a786f43eff5dc52b16be00d6f6cef8dad73785abdfdaf138ff2623fbfcb2c

SHA512
d0df2bdbab6d6719ac5f343fe8729b59fab624f3fe35cca3d2146d26bc40c0c6e29aed4ab0d07f9245592d33d2982c0993146e177e7d5df76ecd4d596408bf74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
4b976b3820ceb46eb22d98bad397956c

SHA1
f8267c068e9af1d3c9e0b44c6ec0141d1adfe432

SHA256
94d8e7f7d61a577e7389032046414c553e89e301c377cb2d3ca05b5c42bf786a

SHA512
63665e806b98c1c0362268e8e66cdcc2049c9cf5ad027ab730ce2fcffdd27be41093624f7377c716d06e2307b2cc64ca75b8c127e64dfce942c67d2df2a6c214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5802ab.TMP

Filesize
872B

MD5
91dcdc0c723a9d52e6f5ae8433696db3

SHA1
7873f5b7aab04597a0be3b646393fc303562b836

SHA256
a26277483719392cece71d6ec431d5bbcaa22c9c5390a59dd9eaaa25bb83c070

SHA512
1a8b50ede90c145e4edee6fece878a780e588ddcf2dd88c9ff485cf0bc8c2f122f1b18370efe6abfd5228e3e05416127f3a95dac0d3c59e1ffc61491ff487499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be8ec88081e60c8a49ec41fadc65dcff

SHA1
c0f87f2dc93f77e568e5dff72114f880d18c4a3b

SHA256
cd7612b6a6db3e70d136bdc3a0784bee4a0e348ef25985ff6599ec266fe6effc

SHA512
a082c5dbf2f790a4d50669a11370352185ef147acae51a3c5d81d7f0d50b7086e3318abc4f59a0230847395f4bca684542e710dbaea557375251d99e30c1038b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b075ff8fe78c3a6dd4e72b3932a10cbb

SHA1
7f17c21e94e87962a3e9d124e6f0ca7f4ab3aaad

SHA256
7bb846b70590e8d40b998e6bd337c0a0592184d0f0fa197982daa282848909a6

SHA512
c3deff29186e8a2a0aedebe2b71ebbab5f6057ad8936d97647ec058a53ba13781cb8c42bac655293ac63f6c0846e314e731387ee876a74fec0653e21fa12f032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5183d651b4fc8f0c666fea4eae3fca99

SHA1
da7bdc3b752dff11a12fe390cf3cbd2d57fc1836

SHA256
2a25a89560e5e637d7f560b21f21810557b93611242554cb2c183927807ae9d8

SHA512
f34ff606d6f09ba0a3f64dc7a1fa259318478e2158e090fe5cc6bc85e0b572b90907063694b60818dbd248997bc990aaf0a9097eeeae100b51d2532437c5160a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B229.tmp\B22A.tmp\B22B.bat

Filesize
90B

MD5
5a115a88ca30a9f57fdbb545490c2043

SHA1
67e90f37fc4c1ada2745052c612818588a5595f4

SHA256
52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d

SHA512
17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe

Filesize
100KB

MD5
e0f8b21b36fee4e7738a6b5a1ab83673

SHA1
e305d55d4d47bfa62eae5f8e6f34e5b133a6f40b

SHA256
c567d825d19e24343647ed36c77033fb1f46f420384745a9734618684cb7d384

SHA512
716e6624ff87c859d08e2bbcda1137a2386d30b5b9ef545daf2c6585bc3366561773b9ad6c719a1ad99f1bacb219544ae4556629b355250e2234a7f87d24e238

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe

Filesize
1.7MB

MD5
847ee3021803e4adaefcc00aa8283017

SHA1
87644df0985b5ef9791c72ce79f423350629659e

SHA256
4611614d9c95b0d0e4bf4aa486cc700db6e49dbef7fa2726b20f165e6798a9f7

SHA512
1aaea476c061160439439d2dadc05e451166faa5614ccf8960b592df6933d07c867ab8813c08026b8b2c35b20b03dc0d26641e228fe06cff8c4938367e515b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe

Filesize
1.8MB

MD5
cfbb3be155b12d0cc69e3d932fbb81eb

SHA1
fb5ed48a80131043c4dd2e4ac69b4b38578f9753

SHA256
fd37c07f519f522eb717a372299525f667439b8b0d1aaffb670a011dbbcd58f2

SHA512
38aadedee5bd57c7f475e96d74abbb0e671bca462c2c700b7a034e2d1513bd8aebc30b7b75bf1e8cd7b7e3a831e69d5dd0ceaee3d18ed296a2cb3d1b051164cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe

Filesize
1.2MB

MD5
252043d1805587b0e65a07f885d6719e

SHA1
2210de44be60ba496ea5d4068e715c1308066989

SHA256
66839bc22b9c9f717198cf8faa64146fe95dff51dfbb8c0f61982f2e50e89557

SHA512
dbcdb0b6fe37cf2c733b6683c2e245008400c84b59450f34a794e513955aaf392982e20f2eb2fce696eec2574fe15f699841748a21fce6a1e20a4381fd52f950

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe

Filesize
1.6MB

MD5
7d377f5e1ba6597ff2cfe4f92639367d

SHA1
188ab803c9926ff3448c458030f418099ea03407

SHA256
c705efd2888dfbede96714b58aede50a28b3da45aba83a909cb104ce34dc735e

SHA512
2adad69f3a358ad955b00c8d7826c396feef9d583407d4c7d53ce3e16ed760f148f553f49df5bbcd6c5c68b87bcf7e1472d3c789946b23dab7ae94b4036540e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe

Filesize
725KB

MD5
403a939a04b4384204d35dbc659bf772

SHA1
a5424bc4b18c00fd261d71861fad75502a963397

SHA256
75d5ae4d95b66cb33ccb1b8c39adda5b287ab6c44b11aa42b8f3351024fce1fc

SHA512
860d17990d95694bd7e799b22e6af6fd93a20276439829e945f9aff079b6c708851e8b3e55200b8ef97d41d91608911a414b4a69c26e5593b9b4ca8a134ddbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe

Filesize
1.8MB

MD5
ca7a5693b5b0e8b54d6dad6a5b1b86b5

SHA1
49da08ec9be5e002b0d22dd630182c3a905c76c7

SHA256
2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

SHA512
68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe

Filesize
1.7MB

MD5
144dc3c0a5275a93ff86f00b5c61b9ec

SHA1
784168ab3c4711737656ca13dc4cb59ca267fa45

SHA256
179649325e561f83a53c5cba99cd8f1f589064c8d0f2029fb8e06f61ae986787

SHA512
9af6a9870077621eb046d6fed0fac88eba35edd4cd5e60f49c46018ab633d5cc77ddb9a93886178544198099a4e3b20726a32729ec9d1cf89524b4a579afb783

Download Submit
memory/1932-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1932-69-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1932-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3264-73-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3864-44-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-32-0x0000000002BA0000-0x0000000002BBE000-memory.dmp

Filesize
120KB

Download
memory/3864-62-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-42-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-38-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-36-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-28-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3864-31-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3864-40-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-60-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-29-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3864-35-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-33-0x0000000005990000-0x0000000005F34000-memory.dmp

Filesize
5.6MB

Download
memory/3864-34-0x0000000002EA0000-0x0000000002EBC000-memory.dmp

Filesize
112KB

Download
memory/3864-56-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-46-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-48-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-50-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-53-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-54-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3864-58-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

Filesize
88KB

Download
memory/3932-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3932-89-0x0000000007550000-0x000000000759C000-memory.dmp

Filesize
304KB

Download
memory/3932-88-0x0000000007510000-0x000000000754C000-memory.dmp

Filesize
240KB

Download
memory/3932-87-0x0000000007340000-0x0000000007352000-memory.dmp

Filesize
72KB

Download
memory/3932-86-0x00000000075E0000-0x00000000076EA000-memory.dmp

Filesize
1.0MB

Download
memory/3932-85-0x0000000008310000-0x0000000008928000-memory.dmp

Filesize
6.1MB

Download
memory/3932-79-0x0000000000F20000-0x0000000000F2A000-memory.dmp

Filesize
40KB

Download
memory/3932-78-0x0000000007230000-0x00000000072C2000-memory.dmp

Filesize
584KB

Download