hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/RAT

Resubmissions

01-12-2024 06:01

241201-gq558axrhs 10

01-12-2024 05:58

241201-gn6zqsspak 8

01-12-2024 05:54

241201-gl2l8sxrc1 8

01-12-2024 05:47

241201-gg8vraxqg1 10

Analysis

max time kernel
188s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT

Score

8^/10

aspackv2 discovery

Malware Config

Signatures

Downloads MZ/PE file

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000023d68-238.dat	aspack_v212_v242
behavioral1/files/0x000c00000001db0f-488.dat	aspack_v212_v242

Executes dropped EXE 10 IoCs

pid	Process
4536	Flasher.exe
3464	Flasher.exe
3272	Flasher.exe
1372	Flasher.exe
1920	Flasher.exe
2624	Flasher.exe
1456	Curfun.exe
1944	CrazyNCS.exe
1504	Launcher.exe
316	Melting.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
70	raw.githubusercontent.com
71	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Curfun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrazyNCS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 473334.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 930976.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 511315.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 203227.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 246796.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
1948	msedge.exe
1948	msedge.exe
1988	identity_helper.exe
1988	identity_helper.exe
964	msedge.exe
964	msedge.exe
2328	msedge.exe
2328	msedge.exe
2520	msedge.exe
2520	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
2140	msedge.exe
2140	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 3416	1948	msedge.exe	82
PID 1948 wrote to memory of 3416	1948	msedge.exe	82
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 4000	1948	msedge.exe	83
PID 1948 wrote to memory of 396	1948	msedge.exe	84
PID 1948 wrote to memory of 396	1948	msedge.exe	84
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85
PID 1948 wrote to memory of 3752	1948	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9255346f8,0x7ff925534708,0x7ff925534718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4536
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3464
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3272
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1372
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Users\Admin\Downloads\Curfun.exe
  "C:\Users\Admin\Downloads\Curfun.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Users\Admin\Downloads\CrazyNCS.exe
  "C:\Users\Admin\Downloads\CrazyNCS.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Users\Admin\Downloads\Launcher.exe
  "C:\Users\Admin\Downloads\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3558881996492887012,14745402512928180517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2140

C:\Users\Admin\Downloads\Flasher.exe
"C:\Users\Admin\Downloads\Flasher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a80ef6a8752cb91a792086f2b9ecbe0f

SHA1
228af345b909cd354fd62686a66b45cbbe39afce

SHA256
cf3505426b8a46071f05662af364f7eed118d5464ce5da13f6333292387e28ad

SHA512
bbda73092c39a09aa7a3f55f711043d7eeb84831485afa6f0c5265a2f2189202a2342979444743e335168040b89418b466db8e48a659166a5d9448303bb802b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
f1aefd0d378eb603196ab91261dab17e

SHA1
bd87d469300da02a13972d7038d9f68b06b3ac41

SHA256
fab58f793101ef8ffcce1094e85f8db9c126361c1fcd6d7356c0e896c18b530a

SHA512
cc9c9dd5362ed164e52cd018c1cd53a0b51f7a3df4e99f930d5a05038ebada6cb5ef5b76e7665938d139637fcfa512f6ad806e5d470ae44c3c15963b12c85cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecac812ba59eb543e41fe3c1b333a81d

SHA1
eb8fc8f9a9097d1d2770ea2aeb4095932eaf5825

SHA256
ecba619602bd05efd6e59872809f237cda0c89f86bfe92cf2c3b0f71ff33a07e

SHA512
ed76a32301d571c25c1fbf24d5ebb83aa4e231188842a325322d1939724b1bf3ab01ffd19a63f4b1e73c24cd460c9c4dd8f614b72ce2200c10b8f259ccd94db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4558d3076bc79c03136110825f4edd7c

SHA1
92b2960b19bf3846f155e1369aad461ee35489e2

SHA256
8b885c2f3df230e77a0dcf4d629235eda51c31c3d0635eeb794813b6c207317e

SHA512
39643d4252c2c35a49f0a15a90acced10c233c92ce5249dc62b6df34ec095b39675a7ca4cd48d1e80670e2a921439d55b94e602909ef87057d8f0dcf7bd94fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0f72cdd974982a229487bcce13e3822

SHA1
a3df3ab17284e81b8bb28596908b19390a435c3b

SHA256
16123dbad7bc5c46f4020e9b7fde1af2d2df41303329238a10aec66bf107a747

SHA512
2ab0f3b09b839ac9a7ef59a13743c7384ad4160555fd7197b7d0d1107ac8dcfc8ff566f322aad2578a2aaec4ecd6730598a074244baabaca86fb65ec2d56971f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9084fc123f98c35b74ac55ef1f735710

SHA1
5948e767828deb99d56a82410faaaa962358146c

SHA256
c5534043e9f68242ac93cfa5dabeeff546b153eaa8ed3253874cd64b087817be

SHA512
f49df8e9bc3a9c8ac8c20594393172cff3ac60971b4f606f5a38056ac98a5212eef1c654c1fad362fd9b38a78844abb22e36235cacef74b6f930864ed95ae5d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f1bf7757fc56bacbc7ecc2210454d34

SHA1
414b7ada75de703096676f38236f9ec6a6c983d5

SHA256
2884b03fe423c456097327bf11e774649af08fbcf0078738faba3ca68cd14125

SHA512
2741b6bda026d54534c8013e349a235c731da4a89fd56745388e32ebbdf5d7df78d37a9117b89cd5372788ceeace5941f61d9d61d692692d0002427d6cda1a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d520ab0991cf36f03813d8356df8a7ef

SHA1
4e5103abd0f5a368afaa260eb3e8ae84260a886a

SHA256
27da9b7f927ada4e3b77fb00b8972908ccf91fdd052b320db24a2a7e76be225b

SHA512
5fce77f325d1167c0c315a08e43f0937a0088a5f17e7872d77e4b3b25e7fe395863c22605550345605420c56a9decc39c818762a9b5dda0657fc8e0739f14e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f433ea56dec33d1452a3c538ece7c1ea

SHA1
9bd4aa1735fff0bd82c0a55e98dda5fd5f6288bf

SHA256
f4ebc756787b784afcef1939dc1c12c02529b485ef8c14c5d895724cf88fe6b0

SHA512
4029bce43edf1f4df49678da10d592b68b53f354d2a0ffc7b3f22cab70adc06089c7ff2de992a697b8734996a13f4c2d177cd30f227e86ee03581baf69e18ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
975f6d9534ce67dfd3eaa252135d308e

SHA1
5f029d634cdda38e5b4a222873fb9b3db0751215

SHA256
27ed61d9ff8ac140774422ae1ffa4a871b5b8e19e8ce0b443fec6bcc71326e93

SHA512
03feea00ba5808566c36bb3e40874c3b8c8386213b857966baf964d9db30ec18235d3b592b507aba6815534ca9a05d9a8699f76c88681eb8159f29dc30881b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b6de0c6b851fd22401bc324fcdb06d5

SHA1
dabda03aa99050a25b5a862b98fc5f9bc0bf2a77

SHA256
29f4deca6650d9c6bf28a36c10f37bfcace5e27049b60a00f25858366963e07f

SHA512
13ad0f052cab312d3b141e353868a46b289d0a22e2c936fdcc7d8604f0a93b6d1709c17122613d352af8b2ea6c6d984a454d8bcf7a3afc2d8ee8b4ee3e10c259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
03071e2306869c777e798c7d81a7af14

SHA1
a01ea75082aec380230ff93e6ca715e9d0463082

SHA256
31aa8bef498109c8c2b21fff3d92618f6496f4b715654d2b42ba8c920c53d06c

SHA512
4d2632d7a5a63d1b7a22b0f4ea1a9a7be7b2763bc0fca6d82c773a00e4511b47a333ffa9032cd8205b9e0e85d30038e3ae64f354a4f5848bb6ab677e8d46e196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c6a.TMP

Filesize
874B

MD5
de33ec6e09efc999d552f3b06fccd0b9

SHA1
8900bb854c30b62af6490d13b8e2bda5747d0e43

SHA256
10fce419fd24cccfb8a6a0286dd74d15187d6c6fc1ecc3afac4319194890a396

SHA512
1177617d10f269e1f9cb60b253dfcfb2dad292fa0278817ee0b26528af67cbe7d305392e4cad104d2f47428008ebe6bc0a9c0700c7612c13b274c0aac6712cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
811628728b4e0ace6982f246c87bef38

SHA1
76edab4856f5d286ed6dce3f09a84595b55908b1

SHA256
c923fe39868d6c89f53ce44d60a9dac763036e0773da9b0e5714d06dc6add4ed

SHA512
476d27a8e4aeaf9ce2438cceaa2949d45f28d3be25fdd43d34debbb0db1f973fb28466b29974e82b570cd884b6abd40310e1b12c42c566e5ffa6092fc9f6a18b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b12d0e2f0cd12469c6deccfd8f21d31

SHA1
ec897e15affaab52c78718f660d3faa3a03b9dfc

SHA256
89a6a8db676b248326bd82092c2778edce8e1892bd08ddc10676d8d3e443eca8

SHA512
d3af9026c4fe528ef89744f797ba696c7a7ace8a45299a915bd92abb5eaec09abc2075e0e83e0320ef3732396ba1f6807fba32895377806578988f5884d06b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b2fec4ed3901632487a23936edd3d72

SHA1
ec0429ddd04202676f64a5fe5ee39da48321ef40

SHA256
4fc015cb243b4c18461362bfbc6e8d8908e0dae6781678f94c1393711d7787c5

SHA512
c2ce9ce1a928300d0963190b0db4aad90b8c3c5c60e0404e6611862e6e779e9ec1bb30bf6f2e9f72633391a952c2f6bc6abba30e2fcdc2b11d828150f48b370f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d5df38cf3015876e8114e947895a950

SHA1
694ab47f6a5fc9b46d2a74a7f1acc45460be3029

SHA256
c02cab2494612e44a3db04a1cf1ff3ae972cbaa16ee8b17de51350bc09c06ff0

SHA512
2485e66ca653562527747687cd440c06caafe436e998e158ebd77b2446906bb3662a5e256ceeb4aea0cc523c4b5cd6ac2fc1f09e6a21eb837f64fc07a64bf83a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a004e5fb4e39f459a847a3d1c47597b4

SHA1
f7ebba3c32a9c6dcbbdff5de0a25c5b91209e30d

SHA256
b4ab20c5968572e5c54145bbdfbe511da2625eb9c4e08ba45ca95d5628eafa32

SHA512
f9178f205b909a3a93d7f648e5ca80e7851de0c520985cd0453ac6f316012a24a1c0d214d8774ad990327d9fca42cbe60610d35efe2b2a32fe172e8505a0ce1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39523275ecdfca2bb8f02ef871b98acd

SHA1
94fdf24b136bb01807ad1b9be6d4064742b26379

SHA256
459be60a55ed46087a1387d67e32f779cd54dcebdd9d77a3f9ce6104036ce861

SHA512
458612d0a6a90237c670cf17dc129a2649203aec8e189e3081bc31cd796b14c7a0d0846091481d18bfaf1943ca6452bf0cb903b02b9de657c33333fb2c8ee93d

Download Submit
C:\Users\Admin\Downloads\Melting.exe

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 203227.crdownload

Filesize
197KB

MD5
7506eb94c661522aff09a5c96d6f182b

SHA1
329bbdb1f877942d55b53b1d48db56a458eb2310

SHA256
d5b962dfe37671b5134f0b741a662610b568c2b5374010ee92b5b7857d87872c

SHA512
d815a9391ef3d508b89fc221506b95f4c92d586ec38f26aec0f239750f34cf398eed3d818fa439f6aa6ed3b30f555a1903d93eeeec133b80849a4aa6685ec070

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 246796.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 473334.crdownload

Filesize
246KB

MD5
9254ca1da9ff8ad492ca5fa06ca181c6

SHA1
70fa62e6232eae52467d29cf1c1dacb8a7aeab90

SHA256
30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6

SHA512
a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 511315.crdownload

Filesize
122KB

MD5
d043ba91e42e0d9a68c9866f002e8a21

SHA1
e9f177e1c57db0a15d1dc6b3e6c866d38d85b17c

SHA256
6820c71df417e434c5ad26438c901c780fc5a80b28a466821b47d20b8424ef08

SHA512
3e9783646e652e9482b3e7648fb0a5f7c8b6c386bbc373d5670d750f6f99f6137b5501e21332411609cbcc0c20f829ab8705c2835e2756455f6754c9975ac6bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 930976.crdownload

Filesize
138KB

MD5
0b3b2dff5503cb032acd11d232a3af55

SHA1
6efc31c1d67f70cf77c319199ac39f70d5a7fa95

SHA256
ef878461a149024f3065121ff4e165731ecabef1b94b0b3ed2eda010ad39202b

SHA512
484014d65875e706f7e5e5f54c2045d620e5cce5979bf7f37b45c613e6d948719c0b8e466df5d8908706133ce4c4b71a11b804417831c9dbaf72b6854231ea17

Download Submit
memory/1372-451-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1372-309-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1456-384-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1456-411-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1456-453-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1456-560-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1456-483-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1456-532-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1504-557-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1504-547-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1920-452-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1920-310-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1944-465-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2624-463-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/2624-314-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3272-308-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3272-450-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3464-449-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3464-307-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4536-294-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4536-446-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download