elysiumstealer | a868724002d7af3c0ed880a3b56f2256d4c60d4bcd61bd5607b894aa72b51423

Analysis

max time kernel
73s
max time network
75s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
19-11-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tools.exe
Size

17.8MB
MD5

6f9a824001b0124db66f808ecab25cbd
SHA1

539b08d754fc3eb100ac189c9ae4ac100fd0ed0c
SHA256

a868724002d7af3c0ed880a3b56f2256d4c60d4bcd61bd5607b894aa72b51423
SHA512

0c6371b0e5749f3c029eb89fa94c1751a9b1f552654df2e2acb595b513dfadff2875dbc5f40bf268f682387a0c62514b90f5705d7110b3d07853bd4a978ca1c4
SSDEEP

393216:VEVCNjvwNIJfa86uq97Nw3qi6LjwrtOquHNb5uXdKDL+i:CVCNrSIQ86p9ia/MtjuHx8Xkqi

Score

10^/10

elysiumstealer defense_evasion discovery persistence stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

resource	yara_rule
behavioral1/files/0x00280000000450d8-9.dat	elysiumstealer_dll

Elysiumstealer family
elysiumstealer

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 16 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BstkSVC.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BstkSVC.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Agent.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Agent.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Player.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bluestacks.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BstkSVC.exe	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bluestacks.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Agent.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Player.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Player.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bluestacks.exe\PerfOptions	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	Tools.exe

Loads dropped DLL 2 IoCs

pid	Process
2296	Tools.exe
2296	Tools.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\49d44785-f4d9-4451-b1c2-6233cb3b417d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241119103525.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Tools.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Tools.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Tools.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2296	Tools.exe
2296	Tools.exe
2296	Tools.exe
2296	Tools.exe
4964	msedge.exe
4964	msedge.exe
3296	msedge.exe
3296	msedge.exe
1372	identity_helper.exe
1372	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	Tools.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2216	2296	Tools.exe	92
PID 2296 wrote to memory of 2216	2296	Tools.exe	92
PID 2296 wrote to memory of 2216	2296	Tools.exe	92
PID 2296 wrote to memory of 1948	2296	Tools.exe	94
PID 2296 wrote to memory of 1948	2296	Tools.exe	94
PID 2296 wrote to memory of 1948	2296	Tools.exe	94
PID 2296 wrote to memory of 2960	2296	Tools.exe	96
PID 2296 wrote to memory of 2960	2296	Tools.exe	96
PID 2296 wrote to memory of 2960	2296	Tools.exe	96
PID 2960 wrote to memory of 4808	2960	cmd.exe	98
PID 2960 wrote to memory of 4808	2960	cmd.exe	98
PID 2960 wrote to memory of 4808	2960	cmd.exe	98
PID 2296 wrote to memory of 392	2296	Tools.exe	99
PID 2296 wrote to memory of 392	2296	Tools.exe	99
PID 2296 wrote to memory of 392	2296	Tools.exe	99
PID 392 wrote to memory of 4584	392	cmd.exe	101
PID 392 wrote to memory of 4584	392	cmd.exe	101
PID 392 wrote to memory of 4584	392	cmd.exe	101
PID 2296 wrote to memory of 1116	2296	Tools.exe	102
PID 2296 wrote to memory of 1116	2296	Tools.exe	102
PID 2296 wrote to memory of 1116	2296	Tools.exe	102
PID 1116 wrote to memory of 1900	1116	cmd.exe	104
PID 1116 wrote to memory of 1900	1116	cmd.exe	104
PID 1116 wrote to memory of 1900	1116	cmd.exe	104
PID 2296 wrote to memory of 2208	2296	Tools.exe	105
PID 2296 wrote to memory of 2208	2296	Tools.exe	105
PID 2296 wrote to memory of 2208	2296	Tools.exe	105
PID 2208 wrote to memory of 116	2208	cmd.exe	107
PID 2208 wrote to memory of 116	2208	cmd.exe	107
PID 2208 wrote to memory of 116	2208	cmd.exe	107
PID 2296 wrote to memory of 220	2296	Tools.exe	108
PID 2296 wrote to memory of 220	2296	Tools.exe	108
PID 2296 wrote to memory of 220	2296	Tools.exe	108
PID 220 wrote to memory of 1624	220	cmd.exe	110
PID 220 wrote to memory of 1624	220	cmd.exe	110
PID 220 wrote to memory of 1624	220	cmd.exe	110
PID 2296 wrote to memory of 4368	2296	Tools.exe	111
PID 2296 wrote to memory of 4368	2296	Tools.exe	111
PID 2296 wrote to memory of 4368	2296	Tools.exe	111
PID 4368 wrote to memory of 4640	4368	cmd.exe	113
PID 4368 wrote to memory of 4640	4368	cmd.exe	113
PID 4368 wrote to memory of 4640	4368	cmd.exe	113
PID 2296 wrote to memory of 3324	2296	Tools.exe	114
PID 2296 wrote to memory of 3324	2296	Tools.exe	114
PID 2296 wrote to memory of 3324	2296	Tools.exe	114
PID 3324 wrote to memory of 2812	3324	cmd.exe	116
PID 3324 wrote to memory of 2812	3324	cmd.exe	116
PID 3324 wrote to memory of 2812	3324	cmd.exe	116
PID 2296 wrote to memory of 2796	2296	Tools.exe	117
PID 2296 wrote to memory of 2796	2296	Tools.exe	117
PID 2296 wrote to memory of 2796	2296	Tools.exe	117
PID 2796 wrote to memory of 444	2796	cmd.exe	119
PID 2796 wrote to memory of 444	2796	cmd.exe	119
PID 2796 wrote to memory of 444	2796	cmd.exe	119
PID 2296 wrote to memory of 4412	2296	Tools.exe	120
PID 2296 wrote to memory of 4412	2296	Tools.exe	120
PID 2296 wrote to memory of 4412	2296	Tools.exe	120
PID 4412 wrote to memory of 4820	4412	cmd.exe	122
PID 4412 wrote to memory of 4820	4412	cmd.exe	122
PID 4412 wrote to memory of 4820	4412	cmd.exe	122
PID 2296 wrote to memory of 1672	2296	Tools.exe	123
PID 2296 wrote to memory of 1672	2296	Tools.exe	123
PID 2296 wrote to memory of 1672	2296	Tools.exe	123
PID 1672 wrote to memory of 2136	1672	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Tools.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q /f %TEMP%\*
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q /f C:\Windows\Temp\*
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks\Config" /v "ForceDedicatedGPU" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks\Config" /v "ForceDedicatedGPU" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks_msi2\Config" /v "ForceDedicatedGPU" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks_msi2\Config" /v "ForceDedicatedGPU" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\Bluestacks.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\Bluestacks.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\BstkSVC.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\BstkSVC.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\HD-Agent.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\HD-Agent.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\HD-Player.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks\\HD-Player.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\Bluestacks.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\Bluestacks.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\HD-Agent.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\HD-Agent.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\HD-Player.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\HD-Player.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\BstkSVC.exe" /t REG_SZ /d "GpuPreference=2;" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\\Program Files\\BlueStacks_msi2\\BstkSVC.exe" /t REG_SZ /d "GpuPreference=2;" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bluestacks.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1016
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bluestacks.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BstkSVC.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2692
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BstkSVC.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Agent.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Agent.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Player.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1136
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HD-Player.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/vEwxSTwA#KIxJIBiy7Ke-sk34l0KurPgTODRwtzNuvjcP7l-wDmE
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffa20ca46f8,0x7ffa20ca4708,0x7ffa20ca4718
    3⤵
    PID:520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18005567443322832851,1476630293708441390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,18005567443322832851,1476630293708441390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,18005567443322832851,1476630293708441390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18005567443322832851,1476630293708441390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18005567443322832851,1476630293708441390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18005567443322832851,1476630293708441390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x120,0x254,0x7ff74b105460,0x7ff74b105470,0x7ff74b105480
      4⤵
      PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18005567443322832851,1476630293708441390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6126b3cef466f7479c4f176528a9348

SHA1
87855913d0bfe2c4559dd3acb243d05c6d7e4908

SHA256
588138bf57e937e1dec203a5073c3edb1e921c066779e893342e79e3d160e0b4

SHA512
ef622b26c8cee1f767def355b2d7bffb2b28e7a653c09b7e2d33f6468a453fff39fd120cacbffd79ce35722592af0f3fb7d5054e2dca06310e44dc460533f3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dda6e078b56bc17505e368f3e845302

SHA1
45fbd981fbbd4f961bf72f0ac76308fc18306cba

SHA256
591bf3493eb620a3851c0cd65bff79758a09c61e9a22ea113fa0480404a38b15

SHA512
9e460013fd043cee9bdbcdaf96ac2f7e21a08e88ddb754dddbd8378ee2288d50271e66b42092d84a12e726469465185be11a6fafab6ed4236a244524bd60f502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
e9e72a65c126df7731245021137707eb

SHA1
f25cfd1bf40dc5ca8f767925622baa41bd8eefcf

SHA256
edac4b323b1ab34aef0b64ecc63c6cf9472c4c76ebbdd578defa1ca76864112b

SHA512
665094ae96dd1609987914c773b7729c3f18f6c8dc95c48b46317486f280f4097af5bdefa86ad797dc1213192bff80be0d9edf94bfe6592c33e0bfd95e25a3e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
98038790d6f767970b30b4a4769df7e8

SHA1
d4a1ab06e0ba0d249a820a07c1fc17c69093f507

SHA256
086d1ab36d2b625bbad1bc39063b0b207647251564a37cbb4a55ebfd060ddda3

SHA512
82608d271b5bcd814c6b1abbab6f13ad9c331860fd940055349cf47c951fd1e92aa1ab8c2bd93e52c14a47812d13a534beff7569914dcc43b5e9f821fadb1e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc924dcb4d787a220a485cb137f41ce8

SHA1
94464590430f731b2c739eb0a73215bb403018a9

SHA256
da4e69267b8bc560047643a6114909c19024f46844f84b034338cfe95c4d1f66

SHA512
09098caca881c9f0824d765662f3724da00e18adc4b8021da7e71dbfd141ae88d5e15bf7b29de9aa3fcbc26f52bb713e3c9360f06df45f4865f98a462867681a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
c0b69175a9cf2c3bf2fa93e8895634ef

SHA1
b49c13400b8a3ed3050c3b1c138ef32c0dd6d44d

SHA256
907fb80239582f27abe9bb1bb277745a7cf66bdc4657d4123c5b8cb56dc7d958

SHA512
d37015826ca8b9b5ca4a9c7261798fddb1e878d4cc1fe674f435c30f2e1118da6d81fcd4c34385425dd504b4e7274d0e49d6ebe0094dcf285801d99e1f7987cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
90cc75707c7f427e9bbc8e0553500b46

SHA1
9034bdd7e7259406811ec8b5b7ce77317b6a2b7e

SHA256
f5d76f8630779de1fe82f8802d6d144861e3487171e4b32e3f8fffd2a57725fb

SHA512
7ad692bce11aee08bf65bb7c578b89a4a3024211ee1deaf671c925d65cc016943f2caad3d57b365e16d1764c78c36cae35c3c45cef0928dd611a565b0313e511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
931b19c22253dcfe30f857f91ee82dde

SHA1
6f678be94fd2f87c06b65b3004557833aedddc67

SHA256
6b18fdc7be76ebdab0b6368aa0cb6c7e9384f598bbd999237e470dc80470d416

SHA512
6cc75fae562dc84143154f782d0eb0fa4d3628fbb541f4b5a2ae2edf0168aa111b809eba4acdbdab943ecdd182c36b955cff08d00d8989809f6063b0449abb37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5cdbb6f36eb1aa0f3e27f476a2631770

SHA1
ca71193f7f762967880129c2ea7a8ac0cb9d5a2a

SHA256
a91d64cde69a9389a4dfcc2eed984e9078517e22bf4711dc1ac1b2f0bd410e4f

SHA512
ab41079a2915ac34acd47beeaee9876583f344c2f464192cafef63c9a323f14739b59cb5fb1d12d4e0bee7c6ed5083aea1ca18e75d0e957aa403cfb2f4bea28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e5a8.TMP

Filesize
48B

MD5
f8ffbc590984d5276f0e90e3fbfed41b

SHA1
3ee22c5a7a22eec79fb1a2dade753af66feb0673

SHA256
b743d60469460af5f16b180d4e634a02dec86e97b8d239a424bd9e123ecf456f

SHA512
036604f65174e0d37b92f3cf47b6f6560cf24e1e5b3ed740be327e2be14f7e6454b17c0a5040a87a1654658395968da5bac1e46fcc0a5929328f3cb0ef137b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
af8af524b64d582990711fb4d836973f

SHA1
4f6f672b479982d1271be917b999333ffc51e7aa

SHA256
839bcf5832ef04139721f0e6b013de864deb9ae4199adee65ba594b369a2512c

SHA512
aba0f20cfae2a4bd2d484d8ee2bf0a827cc65cb7549548e6db2f7c5e5fa84c2a167ee98f04f7b46241eaa82e1815b25602d424c54bff6f70116425e7992e499f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\VaultVM.Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD978.tmp\39ead13f-e712-4af7-96c2-ba840345c7fe.dll

Filesize
770KB

MD5
fcdce22248e6f6751dd6e67360f2abd8

SHA1
689711c1954bc5f50a73b092e31a68f4a19299b9

SHA256
d5e1bef0eb91637790223515625e2c0dd77bb4591d2e58d1f65cfe0c75577c65

SHA512
d4e8ac8f8900dfd3041747cc116773008191fcd754fb1eec8e4cffe343393250adc02d7c55ddf11f4fc4c649bd27f3004b0ed65484659130d5ebc60ff23cc5dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b1639c8c4c3fa5e9f2e17551c9749d14

SHA1
8f6926e9c128a5f97fe9a8d37eaf1314423c4e02

SHA256
5dc11a5d23081914fc263e724eeb7e083cca13b9f925e321cc60a6589a84ea2a

SHA512
a0ed9eca81153ba17976afa8274358e8630421ace7fc869972ddd156506f7c3bca6ffac9ff8c9629dba7fe90c74fc8fc47742a0a524acebd6319180eb8749673

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
531f6b0324112e88ee52c6ac56767abf

SHA1
0aae75a072b7c8705b49176942b5f550b3ed4a02

SHA256
564dd846e2a5c211c85d6bce743636e647f909dd62b5c2d9c8bb9b2455f5dc13

SHA512
a22d217df248666e24836b4860fd8040f5b28cf2cd2f8e14979143edcdab3fef2e44931186baf3a431300a0d1245d27f491a4af24a3efd8bb3f074fd5579c5e0

Download Submit
memory/2296-15-0x00000000069F0000-0x0000000006A02000-memory.dmp

Filesize
72KB

Download
memory/2296-25-0x00000000749A0000-0x0000000075151000-memory.dmp

Filesize
7.7MB

Download
memory/2296-23-0x00000000749A0000-0x0000000075151000-memory.dmp

Filesize
7.7MB

Download
memory/2296-22-0x00000000749A0000-0x0000000075151000-memory.dmp

Filesize
7.7MB

Download
memory/2296-21-0x00000000749A0000-0x0000000075151000-memory.dmp

Filesize
7.7MB

Download
memory/2296-20-0x00000000749AE000-0x00000000749AF000-memory.dmp

Filesize
4KB

Download
memory/2296-19-0x0000000019EF0000-0x0000000019F2C000-memory.dmp

Filesize
240KB

Download
memory/2296-18-0x00000000749A0000-0x0000000075151000-memory.dmp

Filesize
7.7MB

Download
memory/2296-17-0x0000000008760000-0x0000000008974000-memory.dmp

Filesize
2.1MB

Download
memory/2296-16-0x0000000006A60000-0x0000000006A6A000-memory.dmp

Filesize
40KB

Download
memory/2296-0-0x00000000749AE000-0x00000000749AF000-memory.dmp

Filesize
4KB

Download
memory/2296-14-0x0000000006A70000-0x0000000006B02000-memory.dmp

Filesize
584KB

Download
memory/2296-13-0x00000000090A0000-0x0000000009646000-memory.dmp

Filesize
5.6MB

Download
memory/2296-12-0x0000000015530000-0x000000001665A000-memory.dmp

Filesize
17.2MB

Download
memory/2296-7-0x00000000749A0000-0x0000000075151000-memory.dmp

Filesize
7.7MB

Download
memory/2296-6-0x0000000006820000-0x000000000682E000-memory.dmp

Filesize
56KB

Download
memory/2296-1-0x0000000000C30000-0x0000000001E00000-memory.dmp

Filesize
17.8MB

Download