netsupport | hxxps://gemini-desktop[.]com/download/gemini[.]exe

Resubmissions

10/01/2025, 03:28

250110-d1vwfszqbt 8

10/01/2025, 03:26

250110-dzcy9aspfr 8

08/01/2025, 04:07

250108-epr6vswjcl 8

08/01/2025, 03:43

250108-d94vqaspcw 10

Analysis

max time kernel
246s
max time network
230s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2025, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gemini-desktop.com/download/gemini.exe

Score

10^/10

netsupport defense_evasion discovery evasion rat themida trojan

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Netsupport family
netsupport

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	client32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	client32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	client32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.lnk	driver.exe

Executes dropped EXE 4 IoCs

pid	Process
1684	gemini.exe
4356	gemini.tmp
688	driver.exe
3924	client32.exe

Loads dropped DLL 5 IoCs

pid	Process
3924	client32.exe
3924	client32.exe
3924	client32.exe
3924	client32.exe
3924	client32.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x010000000001e875-239.dat	themida
behavioral1/memory/3924-247-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-248-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-249-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-250-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-251-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-346-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-347-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-362-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-363-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-364-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-365-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-378-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-393-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-394-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-395-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/3924-396-0x0000000011000000-0x0000000011B06000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	client32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
59	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3924	client32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gemini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gemini.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1940	NETSTAT.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 35650.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4212	msedge.exe
4212	msedge.exe
1840	identity_helper.exe
1840	identity_helper.exe
2860	msedge.exe
2860	msedge.exe
4356	gemini.tmp
4356	gemini.tmp
3924	client32.exe
3924	client32.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3924	client32.exe
Token: SeDebugPrivilege	3520	taskmgr.exe
Token: SeSystemProfilePrivilege	3520	taskmgr.exe
Token: SeCreateGlobalPrivilege	3520	taskmgr.exe
Token: SeDebugPrivilege	1940	NETSTAT.EXE
Token: SeSecurityPrivilege	3520	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3520	taskmgr.exe
Token: SeBackupPrivilege	4564	svchost.exe
Token: SeRestorePrivilege	4564	svchost.exe
Token: SeSecurityPrivilege	4564	svchost.exe
Token: SeTakeOwnershipPrivilege	4564	svchost.exe
Token: 35	4564	svchost.exe
Token: 33	3520	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3520	taskmgr.exe
Token: SeDebugPrivilege	2144	taskmgr.exe
Token: SeSystemProfilePrivilege	2144	taskmgr.exe
Token: SeCreateGlobalPrivilege	2144	taskmgr.exe
Token: SeSecurityPrivilege	2144	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2144	taskmgr.exe
Token: SeBackupPrivilege	4564	svchost.exe
Token: SeRestorePrivilege	4564	svchost.exe
Token: SeSecurityPrivilege	4564	svchost.exe
Token: SeTakeOwnershipPrivilege	4564	svchost.exe
Token: 35	4564	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe
3520	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 408	4212	msedge.exe	83
PID 4212 wrote to memory of 408	4212	msedge.exe	83
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 2116	4212	msedge.exe	84
PID 4212 wrote to memory of 4792	4212	msedge.exe	85
PID 4212 wrote to memory of 4792	4212	msedge.exe	85
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86
PID 4212 wrote to memory of 4000	4212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gemini-desktop.com/download/gemini.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1b3f46f8,0x7ffd1b3f4708,0x7ffd1b3f4718
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,11022322032008704393,14786601012166726980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Users\Admin\Downloads\gemini.exe
  "C:\Users\Admin\Downloads\gemini.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\is-S7A54.tmp\gemini.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-S7A54.tmp\gemini.tmp" /SL5="$D021E,107203419,761856,C:\Users\Admin\Downloads\gemini.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\is-N9TS7.tmp\driver.exe
      "C:\Users\Admin\AppData\Local\Temp\is-N9TS7.tmp\driver.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:688
    - - C:\Users\Admin\AppData\Roaming\update\client32.exe
        
        "C:\Users\Admin\AppData\Roaming/update/client32.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C del /f /q "C:\Users\Admin\AppData\Local\Temp\is-N9TS7.tmp\driver.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3520

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1536
- C:\Windows\system32\NETSTAT.EXE
  netstat
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd315831e0caa1d1ea0a3079da51238b

SHA1
614b5c5ad1abb5dd209742a719fdf83b7848823c

SHA256
0a319c9afddb7ff199b44180e40559c9888fe8424f9169dfa2c6947fe3530fbe

SHA512
1073c27156f0daf573438faca586eee33ef2b5bc224a629d120b2fe378f626a75203932aa4ea01130606878ca77d51b0b7e4dd992990c5f684d916f57ab7edd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11ce107802bbb158b906c9e24a68aa12

SHA1
e9c8409e86d5773090ea97763db78b0366499293

SHA256
6c4f00c97277e65435b961fa340520bf827d999de1e1cc72cf42c18a94354e70

SHA512
694e66f3c412db45b19f89988bcbf75f73d6eca5836e96887682a6bc0e71a0c170cdc6169fcaca9741fff5d230bb511001895b6c6e28128fd09cd66e09ebe183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6c3573644ecb7f8f64ad76f5d94a3ae

SHA1
c4d33febeb46ad23a9e411cec2c3ece3eb2b0c08

SHA256
4fcf92092b65c78d5d6e15cd90b8ca40d58df0fcfa900af6b6e4ed80256a858f

SHA512
a87a15e3b3f461ea5b0b3847a663ab587e8749508dc34f635d943368e15a8692bd20016714d10edf5a932cbd6b3bba4395b84e01c671c46c2dc6d0602e05e4e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
55dda5ad7c85b3269b2bafeb7cec3e0d

SHA1
0be0e70eb3dc398523d0ea68b912208e52c4c466

SHA256
b0df461d7a68c01fa11939294c57f59da37ea71a2695fe4dcb95729f852f854e

SHA512
8c2ff3fcd17fca813a6906436465307bf58d612179c82568e679632c09f7246bfbf1f5ee33025fb7b57d617dc81acee95b6b5699cbcbb1c5fdbed73a6a8f3ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
655f090befb48ed077f16caeacf689ed

SHA1
7bfd248cf5cdcbfd89549ce3ecc33591084a9b34

SHA256
32c15c3269cdb8adeae498872277999ebbd952fefc2b2add0efcc15e5ad7f57b

SHA512
f42d7fa7b2fbb39dd8bf5b9132a7d24d5313d74af5d6ef17d11db3f6fef9bbf154ea799d72abf6a9f7d3df3fc0e5232137358944bd0544eb179b495bc5051103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb4d45b99de360036cf149a943160677

SHA1
a69eaa9b2c455520c0190ba4d0c64240f7478fb9

SHA256
09ba20b650ca4254260d112db7dbdb4fef3712f07344ec6d26d20774fb7b2b9c

SHA512
7e5dc670348a7ba0a403064aa417487003bd622e6b224db2bf8af395178012fe2b45e365db414eb293cba97ae570d008c4f1cd86bf4fe9032daa000adf367fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
8aff7f2376934251f77f96a23975bff5

SHA1
c0e5967145c26425d746a6be59706ec5297a2169

SHA256
dd47b34f81d005da87a12291a6a03a1ebb0a023d0492fb76c12ff3f017c116bc

SHA512
5b3171ee5b96e0c4542038aa6bf2321cdbd77aa2ae360e0e527973ed2ddd4d3fb23e9398c710103759d53d0a417ea9ea5d8eebf9763b7e3fa00f55a53e07213b

Download Submit
C:\Users\Admin\AppData\Local\Temp\extracted_files\AudioCapture.dll

Filesize
87KB

MD5
7629af8099b76f85d37b3802041503ee

SHA1
f40a5efcb9dee679de22658c6f95c7e9c0f2f0c0

SHA256
2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5

SHA512
c209714ffdb0b95595583976340f2eb901eb9895f2f420afc4ca3c12744432e52fbedfd857b56cb347d4475df7678bd42d43f221208a108384e1df5aaf7d19e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N9TS7.tmp\driver.exe

Filesize
7.2MB

MD5
f0f8cdf115e89e3caab43f50658ba709

SHA1
19dfa9bc7437c7ec11dd4192700f2b9c9b324cef

SHA256
cfc26c6a0f8fec7312ba9c79a3d186cbe01867936c7ade98f201fbf9b6ab90a5

SHA512
697ad6802af19932003ea95ad0210b782d778ae41aefb1192a4ff58b05c1c124d9935df60e16e374dc7c1e0f4e197e4cb423dd10bd81cb8c6c6ffd44f48f972e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S7A54.tmp\gemini.tmp

Filesize
2.9MB

MD5
9e3d21ba2007d8f2d178a26c21ced9f0

SHA1
cf39a2f89bc9d72404b74d19b48938f4ae3ee0fa

SHA256
21a8d0d1ac67a892e8d2e4f04e5fae2683bc43e384ef6d9ee6005ddea1b966a1

SHA512
295c7dc56c943b76fdc07a3505a081de21c2c8860b034c77780d8257ac8008fbeaa9240524ce08b2a6bb13530f780b669ebc5d8c5ebd6b0be840d7549bed76b6

Download Submit
C:\Users\Admin\AppData\Roaming\update\NSM.LIC

Filesize
259B

MD5
4e8ecebce46ceef1f6e29c71b6d3be94

SHA1
2345f5203dc819c33782d8f3632f13e835066392

SHA256
76f0b30a1d93469ab744ac81a2f9f96f180e5df964189d3f9b71aef2673dff46

SHA512
80c0949bc0842e036a3ee3ca2023af9465c3f9d6a18a028b1453630a6b1005c9d9b44747600c41899ad551a57510fbe845a7f06df04763ec278189f22b4d2b3e

Download Submit
C:\Users\Admin\AppData\Roaming\update\PCICAPI.dll

Filesize
106KB

MD5
67c53a770390e8c038060a1921c20da9

SHA1
49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a

SHA256
2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689

SHA512
201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d

Download Submit
C:\Users\Admin\AppData\Roaming\update\PCICL32.dll

Filesize
4.2MB

MD5
d1356c062414a92b56b7466b562e9161

SHA1
d8e1dfe082de0b9dbdcef8ce1387dc70efc6d027

SHA256
83a44061672cc24c9cf1b8867ffc4ce0a6c3f2f129d32e7b31b58dfc12fbdea3

SHA512
7076bd0da6bdeded0d356e475096df65aa2a2a0acb5f201bf63b6d8c9d80a6084d8ee7bb5016cc210ff1da07cbe4ef7a1e1c18a7d29ab06d8de6d63d78459730

Download Submit
C:\Users\Admin\AppData\Roaming\update\client32.exe

Filesize
117KB

MD5
7d854e511bf1c3b8ddd0d60fed785bfd

SHA1
8a7dab456bbaf4558e19a474b352e8b9373d7629

SHA256
0d67440514fbb244cf374cd3afa99215ef16ea47dc5b3926afd811270e956f2f

SHA512
feb37323d44f11adeced4179205f62d324cc70f8be87bc76ee9565ede1f82fe3b2811fcb4e58639454f304454d4d71a7f86a50b9ddd02a19c55f7b630a8e26bd

Download Submit
C:\Users\Admin\AppData\Roaming\update\client32.ini

Filesize
745B

MD5
c0b2855f369d2c871ac18c4b04faddd6

SHA1
dac354442dce857bfada924d97205674373bcea1

SHA256
748f494f29d88d8ed48af36c65afb67a43e9c1e7a8bf80aa26f085a89e22cc59

SHA512
acf1baa2592fa7d293aed6fc14aa8716393c9870c9496b80d1b9e282f7b4dc5e82aa652de8243ec65fcbaa75a4c769b83d817dee23f1d1961f526af9770698cc

Download Submit
C:\Users\Admin\AppData\Roaming\update\htctl32.dll

Filesize
316KB

MD5
051cdb6ac8e168d178e35489b6da4c74

SHA1
38c171457d160f8a6f26baa668f5c302f6c29cd1

SHA256
6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269

SHA512
602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36

Download Submit
C:\Users\Admin\AppData\Roaming\update\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\update\office.lnk

Filesize
1KB

MD5
b645868482618c15ed333b39a72ac60e

SHA1
f2bf858e0014bc0e1a29ae531cba87f0e5895c5a

SHA256
e66e9df50f40aa73dc847f6afdf9852000782841df6b808a75e090e9787604dd

SHA512
24ad17f2f9165070f04a9979a804eeac6eb47c10b4f2d79bac4f8f245aee50abea5d3331098119fe1ed10640194d631cbd55cc8f97a55573cbe2c2052fd5fd62

Download Submit
C:\Users\Admin\AppData\Roaming\update\pcichek.dll

Filesize
14KB

MD5
3aabcd7c81425b3b9327a2bf643251c6

SHA1
ea841199baa7307280fc9e4688ac75e5624f2181

SHA256
0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f

SHA512
97605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592

Download Submit
memory/1684-258-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/1684-128-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/1684-97-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/3520-366-0x0000023A7B3B0000-0x0000023A7B3C0000-memory.dmp

Filesize
64KB

Download
memory/3520-354-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-372-0x0000023A7B410000-0x0000023A7B420000-memory.dmp

Filesize
64KB

Download
memory/3520-355-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-356-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-357-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-358-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-348-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-350-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-349-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-360-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3520-359-0x0000023A7CD80000-0x0000023A7CD81000-memory.dmp

Filesize
4KB

Download
memory/3924-347-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-250-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-249-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-378-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-363-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-362-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-247-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-365-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-346-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-364-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-396-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-248-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-395-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-394-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-251-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3924-393-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/4356-257-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download
memory/4356-129-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download
memory/4356-145-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download