metastealer | 3c41f52f95e7064c9fb86253181534a827a755d82c6b9597d4d067c9596f1994

Analysis

max time kernel
286s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

install.msi
Size

1.9MB
MD5

adf228ff4de5e49ddd9ce6612da9f54b
SHA1

1c9710dd7a63fc0887409da1956cdfd5d0d7aa08
SHA256

3c41f52f95e7064c9fb86253181534a827a755d82c6b9597d4d067c9596f1994
SHA512

e9344528e64aa7b5668f258dbef0e5a0f5f5faaa372ab35dcf0f4b639ed05bb2c8d234b33950e761f02a26f10f8f5c5d3f731c98c438308c3819ca1621e4af14
SSDEEP

24576:Yt9cpVDhyji6D67In+B8aGLFm2H38d0NvWKD3pUvi8H5:XpRhyO6DKOytKl31KK8H5

Score

10^/10

metastealer discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

metastealer

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Signatures

Meta Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

MetaStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3400-188-0x0000000010000000-0x0000000010731000-memory.dmp	family_metastealer

Metastealer family
metastealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3440	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4528	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{9CBCC543-3652-4A4B-8708-F22B6FE879F8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF80.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ee86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\e57ee86.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
3400	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
2624	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4028	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001397c7f967de25740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001397c7f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001397c7f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1397c7f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001397c7f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5732	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1588	msiexec.exe
1588	msiexec.exe
3928	msedge.exe
3928	msedge.exe
2232	msedge.exe
2232	msedge.exe
5260	identity_helper.exe
5260	identity_helper.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
3400	setup.exe
3400	setup.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4028	msiexec.exe
Token: SeSecurityPrivilege	1588	msiexec.exe
Token: SeCreateTokenPrivilege	4028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4028	msiexec.exe
Token: SeLockMemoryPrivilege	4028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4028	msiexec.exe
Token: SeMachineAccountPrivilege	4028	msiexec.exe
Token: SeTcbPrivilege	4028	msiexec.exe
Token: SeSecurityPrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeLoadDriverPrivilege	4028	msiexec.exe
Token: SeSystemProfilePrivilege	4028	msiexec.exe
Token: SeSystemtimePrivilege	4028	msiexec.exe
Token: SeProfSingleProcessPrivilege	4028	msiexec.exe
Token: SeIncBasePriorityPrivilege	4028	msiexec.exe
Token: SeCreatePagefilePrivilege	4028	msiexec.exe
Token: SeCreatePermanentPrivilege	4028	msiexec.exe
Token: SeBackupPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeShutdownPrivilege	4028	msiexec.exe
Token: SeDebugPrivilege	4028	msiexec.exe
Token: SeAuditPrivilege	4028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4028	msiexec.exe
Token: SeChangeNotifyPrivilege	4028	msiexec.exe
Token: SeRemoteShutdownPrivilege	4028	msiexec.exe
Token: SeUndockPrivilege	4028	msiexec.exe
Token: SeSyncAgentPrivilege	4028	msiexec.exe
Token: SeEnableDelegationPrivilege	4028	msiexec.exe
Token: SeManageVolumePrivilege	4028	msiexec.exe
Token: SeImpersonatePrivilege	4028	msiexec.exe
Token: SeCreateGlobalPrivilege	4028	msiexec.exe
Token: SeBackupPrivilege	1908	vssvc.exe
Token: SeRestorePrivilege	1908	vssvc.exe
Token: SeAuditPrivilege	1908	vssvc.exe
Token: SeBackupPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeBackupPrivilege	2732	srtasks.exe
Token: SeRestorePrivilege	2732	srtasks.exe
Token: SeSecurityPrivilege	2732	srtasks.exe
Token: SeTakeOwnershipPrivilege	2732	srtasks.exe
Token: SeBackupPrivilege	2732	srtasks.exe
Token: SeRestorePrivilege	2732	srtasks.exe
Token: SeSecurityPrivilege	2732	srtasks.exe
Token: SeTakeOwnershipPrivilege	2732	srtasks.exe
Token: SeDebugPrivilege	3440	powershell.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4028	msiexec.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
4028	msiexec.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2732	1588	msiexec.exe	94
PID 1588 wrote to memory of 2732	1588	msiexec.exe	94
PID 1588 wrote to memory of 2624	1588	msiexec.exe	96
PID 1588 wrote to memory of 2624	1588	msiexec.exe	96
PID 1588 wrote to memory of 2624	1588	msiexec.exe	96
PID 2624 wrote to memory of 4528	2624	MsiExec.exe	97
PID 2624 wrote to memory of 4528	2624	MsiExec.exe	97
PID 2624 wrote to memory of 4528	2624	MsiExec.exe	97
PID 2624 wrote to memory of 1132	2624	MsiExec.exe	99
PID 2624 wrote to memory of 1132	2624	MsiExec.exe	99
PID 2624 wrote to memory of 1132	2624	MsiExec.exe	99
PID 2624 wrote to memory of 3048	2624	MsiExec.exe	101
PID 2624 wrote to memory of 3048	2624	MsiExec.exe	101
PID 2624 wrote to memory of 3048	2624	MsiExec.exe	101
PID 3048 wrote to memory of 2232	3048	cmd.exe	103
PID 3048 wrote to memory of 2232	3048	cmd.exe	103
PID 2232 wrote to memory of 3100	2232	msedge.exe	104
PID 2232 wrote to memory of 3100	2232	msedge.exe	104
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 2184	2232	msedge.exe	106
PID 2232 wrote to memory of 3928	2232	msedge.exe	107
PID 2232 wrote to memory of 3928	2232	msedge.exe	107
PID 2232 wrote to memory of 1992	2232	msedge.exe	108
PID 2232 wrote to memory of 1992	2232	msedge.exe	108
PID 2232 wrote to memory of 1992	2232	msedge.exe	108
PID 2232 wrote to memory of 1992	2232	msedge.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4028

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8135BC0CAA5BC01E7B7463D28FE1A446
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e597e898-83d5-4482-aa9f-12ea2ea0252b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4528
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start msedge https://www.ups.com/media/en/UPS_dev_kit_user_guide.pdf
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.ups.com/media/en/UPS_dev_kit_user_guide.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc8b346f8,0x7ffcc8b34708,0x7ffcc8b34718
        5⤵
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
        5⤵
        
        PID:2184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
        5⤵
        
        PID:1992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:2316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
        5⤵
        
        PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
        5⤵
        
        PID:4408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5152 /prefetch:6
        5⤵
        
        PID:2396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
        5⤵
        
        PID:4860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
        5⤵
        
        PID:1744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
        5⤵
        
        PID:1368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17919122124173774247,7074365002481249751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3972
- - C:\Users\Admin\AppData\Local\Temp\MW-e597e898-83d5-4482-aa9f-12ea2ea0252b\files\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e597e898-83d5-4482-aa9f-12ea2ea0252b\files\setup.exe" /VERYSILENT /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3400
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3440
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
cb1b2b302bfa37d721232c12129194c4

SHA1
8efd322ae85f3934999b0c1cdc2bc97bc7b93c9b

SHA256
73d0ea731e147721f42606fc0a8d0185e25cf62a7bda8612fe1ac971d2032824

SHA512
6de19e9f2fce4bab316b6f3bfc6cd569430a8b550af8d9dd8bf37eed475c4266567e1c36734de1d71335a64aea4e601c15c5bc808fb6156764172e6ef28a3566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
ee738909db99071530c5de2d7fac13a9

SHA1
9f4c05063a962fe11f8fcb52ac4535aa4d80d04b

SHA256
c409552c864575e841778e221a5ec3ffd9db80bf6ddd574be2753431189984aa

SHA512
7796b3a6b70ca15e3e3f89d8ecd51b683a4805a263981e11fab08a79839d90e531e6fddee7b5c8ada026342343ab5ad991ff614650575e2458c5518f683f1c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20fb1197e7572f791145c9d60c4bdcad

SHA1
6e8236c333b85969f132dae869bfef7baa286ba8

SHA256
a331462c8d27f3c7961c849838f975528d6ce5a27c86f2c0b48f35e4e0d48ac3

SHA512
737d3e83d0ff6d505a2189d38e47313ba58ebda8cc886f7b5e9a506a6cf1c0220a68973808abfb5ebdae9293f46644f272cbc313ddbb717248d8feca4f911fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a77b1c151b9aa6caa8b0c3d332864423

SHA1
982c05c18e78f064ce9d3e874a7fc59face15c83

SHA256
c98ea556c57bc21d7104ef881b8a2e18455b57ae263e9e42df3a8f467ee31d9f

SHA512
5e2d04ecee432714a8a10e91fc191ddbef45b912a0a5c202974e6befccbd440e89021ad3f6fffd485b66cfddadcdd82c13b81132841c2ef87da08b51a7c3dca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b8c008a970267a22531e1df3a19dbe2

SHA1
be362bd8e2510a54711839f682a7f4cbd92258ef

SHA256
bb7046f403b8b2ade7a43f7c2389f2d3440ae85a57bb9698a183ea8058bb962e

SHA512
b77066d15356cfb5e3d44c1657e0216c0350f8316b54fad7984137235470b4f645e4053ae55a333f7ffc13f8fa18aa2e4e7527306ed1984950b44d0421172423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c3163fe7eba1a61e0e56719f8238df61

SHA1
6607a58cbe0ce7c1f24f0c65f0418494a8da5d80

SHA256
8e4638d384b9fb5eeeb65a1d5beb4d1166e6d26d5c9065d2a0eef7a4a7071ca3

SHA512
e2f217bddf808db978c648b4e6e11db82670a37aac0e10805a68fd38b4a0fc1019e59f8ec12d517d5053053f8a2a9cda368f2f5535b501420a9d99b095d7d28c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
063c6c41ea64bb3e0d373ac88a632047

SHA1
dd21aebe681e63023676907ae543cd3f9cc9d8dc

SHA256
70d356ab624891e0b1207dccc244109f7df088d70914cd49b21c697f19267816

SHA512
a15f8428599d64342894e8be18aa8580f00557ef40f9f0ad4d185f46c96fd0d862ccb240a2168394e51d00290a12d90edf76646db5f0de71db018d15cd38f565

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e597e898-83d5-4482-aa9f-12ea2ea0252b\files.cab

Filesize
1.6MB

MD5
dfa43908a41275a6618a6f81d2c75ea6

SHA1
898a706b05e1798f7f28dc44d2494ee8bf4c65ef

SHA256
87f42ace101802b193d2826df334dddfac13797a07a1fa03ed05c627bae8db58

SHA512
1155864725642501388d9ddd7b0dbdc1eb15b0198462e89c8574fcee8d93deca864fd2958150b9970ef49debd384152f336fae2c08ec9f164cac5d5ce40952b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e597e898-83d5-4482-aa9f-12ea2ea0252b\msiwrapper.ini

Filesize
380B

MD5
598a939029527908ac9a89dbde03f884

SHA1
1d2790328e1c958983d7c2bf965388b94bba9129

SHA256
72e7b7a99c8277ffe6568fa960eb0b8f2afaf593faddc560efd8757d61d6e66c

SHA512
afac83a6da992c9ebe4f6d208b5fa46ae11ac52ac98c33fad53dbbf54e35d27e958a93c84aa4da0f74400c4cf6e262caac9838f4d43d592f103cef1fa3c50a6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e597e898-83d5-4482-aa9f-12ea2ea0252b\msiwrapper.ini

Filesize
1KB

MD5
9eceeb40eeb9ccc3eb3109307e1572b4

SHA1
e757b3422a295c6328b01aeddcbeecdc726b4ea2

SHA256
758921bf89205f3f175676de50422455d50ccd916227181883ec2d0fbe368965

SHA512
a9ec3816a98bb4a448f4f9d7532a67a1b062ddc01b541f49fde08410acf731d6e6e3cf7c3323b6c164952d4596da32460f5c3b6ddda81ba571714d95b8017c07

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e597e898-83d5-4482-aa9f-12ea2ea0252b\msiwrapper.ini

Filesize
1KB

MD5
ae36398336534f4d61ce07156f5046cf

SHA1
de771b8af6168ac759949a1bcbbb14525f9d0355

SHA256
7756b257e4429b1050a2dfe360fea313c6e17c8624a12c90eedbb6fea37ae325

SHA512
bd7841fb40b15c75ee7d803c4ba63cea1fccfbb03f64c757500a27f95ba935aeb8646f168f2f6392d2b4385b99249f737f81cf8112a79af2f61aab91492ff3e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xkk15wm3.qez.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSIEF80.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
f1a05775c5d9cc9c18c1984636e2c43f

SHA1
cc69699e1f7b659a4ba20122b0284cba444e80f1

SHA256
fd49eb331c545fbcad1ccd8ae83bc5d7a99e25e8dff9336694616cc78fbcb04f

SHA512
4f8b6877dea590668fb53478d84b5b651f7c8161f3e2c3e0efe211694ba22e8ea44779c7a48f5ff9e5bd7554fbfa90f2021bc68eac2255cf342973c8662f39bd

Download Submit
\??\Volume{f9c79713-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{49b14a4b-4f38-41df-b1ab-540690220063}_OnDiskSnapshotProp

Filesize
6KB

MD5
e5dc2628e7ed0fe285f36b689db809e6

SHA1
ae4b9cdd37531c38b3675be8ce3144b8aa2776f5

SHA256
e71b0d8451395e0e85c85462ab8b961784bd637b47e33e3915999b52bfce527d

SHA512
fa725041407d77d3d611369e0af04f4e23d3a6923b2d1ec2d8679c4745f3dca806dac5653a6986cdb096de423745c5475b4e988b412056f4bfa2a334be958f80

Download Submit
memory/3400-188-0x0000000010000000-0x0000000010731000-memory.dmp

Filesize
7.2MB

Download
memory/3440-196-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/3440-225-0x0000000007350000-0x000000000736A000-memory.dmp

Filesize
104KB

Download
memory/3440-195-0x0000000005080000-0x00000000050A2000-memory.dmp

Filesize
136KB

Download
memory/3440-207-0x0000000005A80000-0x0000000005DD4000-memory.dmp

Filesize
3.3MB

Download
memory/3440-209-0x0000000006020000-0x000000000603E000-memory.dmp

Filesize
120KB

Download
memory/3440-210-0x00000000060D0000-0x000000000611C000-memory.dmp

Filesize
304KB

Download
memory/3440-212-0x000000006E4C0000-0x000000006E50C000-memory.dmp

Filesize
304KB

Download
memory/3440-211-0x00000000065F0000-0x0000000006622000-memory.dmp

Filesize
200KB

Download
memory/3440-222-0x00000000071E0000-0x00000000071FE000-memory.dmp

Filesize
120KB

Download
memory/3440-223-0x0000000007210000-0x00000000072B3000-memory.dmp

Filesize
652KB

Download
memory/3440-224-0x0000000007990000-0x000000000800A000-memory.dmp

Filesize
6.5MB

Download
memory/3440-197-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/3440-226-0x00000000073B0000-0x00000000073BA000-memory.dmp

Filesize
40KB

Download
memory/3440-227-0x00000000075E0000-0x0000000007676000-memory.dmp

Filesize
600KB

Download
memory/3440-228-0x0000000007550000-0x0000000007561000-memory.dmp

Filesize
68KB

Download
memory/3440-229-0x0000000007580000-0x000000000758E000-memory.dmp

Filesize
56KB

Download
memory/3440-230-0x0000000007590000-0x00000000075A4000-memory.dmp

Filesize
80KB

Download
memory/3440-231-0x00000000076A0000-0x00000000076BA000-memory.dmp

Filesize
104KB

Download
memory/3440-232-0x00000000075D0000-0x00000000075D8000-memory.dmp

Filesize
32KB

Download
memory/3440-194-0x0000000005270000-0x0000000005898000-memory.dmp

Filesize
6.2MB

Download
memory/3440-193-0x00000000026F0000-0x0000000002726000-memory.dmp

Filesize
216KB

Download