hxxps://cdn[.]discordapp[.]com/attachments/1280292534916222976/1309852965728686080/build-3[.]0[.]8[.]rar?ex=67431722&is=6741c5a2&hm=1592363985f942f29e937ce2c697ec752514fb4bd874c09de9c4da66333f6264&

Analysis

max time kernel
171s
max time network
174s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
23-11-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1280292534916222976/1309852965728686080/build-3.0.8.rar?ex=67431722&is=6741c5a2&hm=1592363985f942f29e937ce2c697ec752514fb4bd874c09de9c4da66333f6264&

Score

9^/10

discovery evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Mapper.exeMapper.exeMapper.execelex.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Mapper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Mapper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Mapper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	celex.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Mapper.exeMapper.exeMapper.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NdNbMiiEoPnxJMDYMPjfIqwmwk\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NdNbMiiEoPnxJMDYMPjfIqwmwk"	Mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oRAZIhGTVosPiJVqbBJpIFWrvPQrQ\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\oRAZIhGTVosPiJVqbBJpIFWrvPQrQ"	Mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PblkwzKjUuSZGFNZBZbzq\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\PblkwzKjUuSZGFNZBZbzq"	Mapper.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Mapper.exeMapper.execelex.exeMapper.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	celex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	celex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mapper.exe

Executes dropped EXE 5 IoCs

Processes:

Mapper.exeMapper.exeMapper.execelex.exeProject1.exe

pid process

4516 Mapper.exe
3724 Mapper.exe
4012 Mapper.exe
3516 celex.exe
3928 Project1.exe

pid	process
4516	Mapper.exe
3724	Mapper.exe
4012	Mapper.exe
3516	celex.exe
3928	Project1.exe

Themida packer 23 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe	themida
behavioral1/memory/4516-78-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4516-80-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4516-79-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4516-81-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4516-84-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/3724-87-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/3724-86-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/3724-88-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/3724-91-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4012-94-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4012-93-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4012-95-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
behavioral1/memory/4012-98-0x00007FF625260000-0x00007FF625AB6000-memory.dmp	themida
C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\celex.exe	themida
behavioral1/memory/3516-110-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida
behavioral1/memory/3516-113-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida
behavioral1/memory/3516-112-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida
behavioral1/memory/3516-111-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida
behavioral1/memory/3516-114-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida
behavioral1/memory/3516-115-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida
behavioral1/memory/3516-116-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida
behavioral1/memory/3516-118-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Mapper.execelex.exeMapper.exeMapper.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	celex.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mapper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

14 raw.githubusercontent.com
22 raw.githubusercontent.com
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

Mapper.exeMapper.exeMapper.execelex.exe

pid process

4516 Mapper.exe
3724 Mapper.exe
4012 Mapper.exe
3516 celex.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
14	raw.githubusercontent.com
22	raw.githubusercontent.com

pid	process
4516	Mapper.exe
3724	Mapper.exe
4012	Mapper.exe
3516	celex.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

Processes:

BackgroundTransferHost.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\build-3.0.8.rar:Zone.Identifier msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\build-3.0.8.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exeMapper.exeMapper.exeMapper.exeProject1.exemsedge.exe

pid	process
3132	msedge.exe
3132	msedge.exe
4560	msedge.exe
4560	msedge.exe
3128	msedge.exe
3128	msedge.exe
2352	identity_helper.exe
2352	identity_helper.exe
4992	msedge.exe
4992	msedge.exe
4516	Mapper.exe
4516	Mapper.exe
3724	Mapper.exe
3724	Mapper.exe
4012	Mapper.exe
4012	Mapper.exe
3928	Project1.exe
3928	Project1.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

Mapper.exeMapper.exeMapper.exe

pid process

4516 Mapper.exe
3724 Mapper.exe
4012 Mapper.exe

pid	process
4516	Mapper.exe
3724	Mapper.exe
4012	Mapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

7zG.exeMapper.exeMapper.exeMapper.exe

description	pid	process
Token: SeRestorePrivilege	4172	7zG.exe
Token: 35	4172	7zG.exe
Token: SeSecurityPrivilege	4172	7zG.exe
Token: SeSecurityPrivilege	4172	7zG.exe
Token: SeLoadDriverPrivilege	4516	Mapper.exe
Token: SeLoadDriverPrivilege	3724	Mapper.exe
Token: SeLoadDriverPrivilege	4012	Mapper.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe7zG.exe

pid	process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4172	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Mapper.exeMapper.exeMapper.exe

pid process

4516 Mapper.exe
3724 Mapper.exe
4012 Mapper.exe

pid	process
4516	Mapper.exe
3724	Mapper.exe
4012	Mapper.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4560 wrote to memory of 2832	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 2832	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3684	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3132	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 3132	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe
PID 4560 wrote to memory of 5112	4560	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1280292534916222976/1309852965728686080/build-3.0.8.rar?ex=67431722&is=6741c5a2&hm=1592363985f942f29e937ce2c697ec752514fb4bd874c09de9c4da66333f6264&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff88aa53cb8,0x7ff88aa53cc8,0x7ff88aa53cd8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=876 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11283937402074553124,4004649913482102197,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2444

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\build-3.0.8\" -ad -an -ai#7zMap24970:84:7zEvent19256
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4172

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\readme.txt
1⤵
PID:4716

C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe
"C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4516

C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe
"C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3724

C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe
"C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4012

C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\celex.exe
"C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\celex.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3516

C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Project1.exe
"C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Project1.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3928

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\readme.txt
1⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://appdata/celex-v3
1⤵
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff88aa53cb8,0x7ff88aa53cc8,0x7ff88aa53cd8
  2⤵
  PID:4152

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c34f457366b27edd6af07faf42017d2

SHA1
e0b86dc5b7bf85fef42e290d711287ff0ee30b29

SHA256
33563ff327ae7a11e84a1a583597cfbcfaf9fbe1ac8dcd2eaf8fab85e1afa6b9

SHA512
e2527e544a3348773c6d465026b4a4af62789385358d495f3105e8b6816b58b40d794aac3904383c5cf29dc8636fd946cbca554d011a64965aec21500279bfc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
952a364e944704099b1bb71e533c7e51

SHA1
3f4717b77a1ddbf864755111ce404cfe9500659f

SHA256
a5b21dd98105eee72b35fc8cd0c6cd4432c5add21d8474a4c461f46d1e1a17b0

SHA512
35a3d32098c446a08855be56071a260e3f4301d54313652665c8b27456e3944e9b0344d5771257d2744aa6efebe442a8b0bf05692ebef9e3a9246b964ccc5b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be048c4bd2ee558481a44b1cd5745c19

SHA1
5d9af04316d75c4f0775f62b1f31d14efe6b20ae

SHA256
110be827ab6512d00c97dbcf9fc7f9c0791ac678787d2b4f8bd2be6b3006b1f8

SHA512
d6bfbf1730ed86630d5dc599d8032ab784934fa115fcb685065aacd9989d6917796dc293e5da302f7216e11aef263a1bd197553d9dfc1eac664c9ac907fcbe9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
320002fcfc8ff78e8d526721d4dd3b51

SHA1
5013540c432b01aa1e68194d148157995d290b1d

SHA256
133c8dd968fd5858c30db58faf8941831d698501a60164e5f0c58a4458735565

SHA512
6a2aa6bb1100e047a990511c5d64c0af2797e9602d3f5f728e0ce7816c9ec38938f842691e7e0ddfd25cb98da9adeab71da91804c40fb8312c877672bc00211e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f7ff7389de2cd659722f5a95d134294b

SHA1
4af2b892b091bff72407db0dc4afe98598f6ce2f

SHA256
85bdf988d835fdce5b15fea28a40355942a96d8732ff48a3c0708710dc3a9e9d

SHA512
385f22e7838dfac9eb14a44e2e02019b9d0add04e3be1648f7598b50392add6528a1708da244951fb707789fbfc4ed3f508ae3701745d1149ff776aaaf54d1dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\49867514-408d-4128-b68d-1ef19eccc168.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\Downloads\build-3.0.8.rar

Filesize
7.9MB

MD5
03b9d85d0fc230e3675c933864c1e5f8

SHA1
b4fdc707b8ce278b6f7b5554b1bf3cb4d9ed6cce

SHA256
71539b427d09969595e7908e995d81a18114cf9d738e49d661d23a06b9f27898

SHA512
452208cf03fe24d9307ee7f22ea4e89318344cb7e09614ee18283ab6d851a6ceaf9ffef0de9fe13108bd409442b331254b375b1e8b0bc0b88039efe0e76add25

Download Submit
C:\Users\Admin\Downloads\build-3.0.8.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Mapper\Mapper.exe

Filesize
3.0MB

MD5
f360158f01156feddbcff28b19c2a305

SHA1
d9fb6edd03401885f5fc81d0855461a8d4932414

SHA256
6752bd7afba1d78337f63a53e81ff63bfb29efd3d9b9835985b2a9017fd0e0c1

SHA512
12159a4ac831a1f6925544d1dee0e7a38aa789736f36b533103850c8201f8012e4fcd888d28400383a79e7ddf45526f85ca1189317739d595f7f24c80abf8e18

Download Submit
C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\Project1.exe

Filesize
63KB

MD5
d92aebe529032940a142d56ee70402e7

SHA1
80dd9e0a496a666e3ce929870465ca6b30e68430

SHA256
d4596515b5ea5832140b1229ca829c6bc7b348b5d684b535eee524433f7a8edd

SHA512
331e58f2bafbea07886b8c6c2dd1c468804e126b22b3ffca5a91f9dd289186159fa4eb6f1ec791f9adc3793d2ad1b1d3d54e657e637481542169f2183a489d69

Download Submit
C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\celex.exe

Filesize
5.0MB

MD5
e7ab71e0cedaf6425702fbb0ca384120

SHA1
c48fc88a2d450e7555326e4af55047971fa139a6

SHA256
23836bd1632860095a96b0ea89114ce74545ae0efcc75c56904cd42fc5a7c0ad

SHA512
6bc7255006680803cb669034729d27b9e9073688f70d325d43493f37c3b8c1ab6bb7fdcd99324d28d66161308483d0a592de4bb69a5d2c0da5b4db296450713c

Download Submit
C:\Users\Admin\Downloads\build-3.0.8\build-3.0.8\readme.txt

Filesize
169B

MD5
6ed8120a13679d8de9c8fa7fa20ffc63

SHA1
f4e082aab47f2484ac09eb4180163816d09b79d0

SHA256
92feeb161daa9cfcab8209426516d0ba1fa6bddb6e75f065ac73b6b8d84df5d5

SHA512
9cc63f13b1201702b44ac99f2c18633ee58437806f127af6256e6cf955f6b08ebc6bb30a4645d0e82b759dadef64c32701830bd78df0ce10f4873795500ee93f

Download Submit
\??\pipe\LOCAL\crashpad_4560_XQYPAUQNXPMWMXTR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3516-112-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3516-114-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3516-118-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3516-116-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3516-115-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3516-110-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3516-113-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3516-111-0x00007FF6DED50000-0x00007FF6DF9AD000-memory.dmp

Filesize
12.4MB

Download
memory/3724-91-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/3724-88-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/3724-86-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/3724-87-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4012-98-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4012-95-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4012-93-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4012-94-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4516-84-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4516-81-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4516-79-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4516-80-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download
memory/4516-78-0x00007FF625260000-0x00007FF625AB6000-memory.dmp

Filesize
8.3MB

Download