smokeloader | d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c

Resubmissions

14/02/2026, 15:12

260214-slchwsg12a10

24/01/2025, 23:30

09/04/2024, 08:35

09/04/2024, 08:35

09/04/2024, 08:35

09/04/2024, 08:35

23/02/2024, 00:53

22/02/2024, 06:18

Analysis

max time kernel
273s
max time network
256s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2025, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Size 141KB
Sample250124-3hgcsatray
SHA256 d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c
MD5 3151d44dd03886e5f64f34481b116c81
SHA1 ebef87d5fd54925493385fbff5ba4d175c046fbc
SHA512 6ebcb293583a6858a023bf71a347783b788064f9415421503155e2f87426ff52d7881f2a680331d4332e4062153901295f4b92771a1afd527624bb15230bbcc6
SSDEEP 3072:p13jvfNcgSRb5hPi9OTtA5HljuEa9ckZKD4Xxh:bTX2gSJL3t0HlyEa9cM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor discovery persistence trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe

Executes dropped EXE 2 IoCs

pid	Process
2636	Procmon64.exe
2916	Procmon64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
668	1916	WerFault.exe	81
4928	3880	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\Procmon64.exe\",0"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open	Procmon64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Procmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Procmon.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\Procmon64.exe\" /OpenLog \"%1\""	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\",0"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\",0"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML	Procmon64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1180	taskmgr.exe
2332	Procmon64.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
2332	Procmon64.exe
2636	Procmon64.exe
2916	Procmon64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	taskmgr.exe
Token: SeSystemProfilePrivilege	1180	taskmgr.exe
Token: SeCreateGlobalPrivilege	1180	taskmgr.exe
Token: SeDebugPrivilege	2332	Procmon64.exe
Token: SeLoadDriverPrivilege	2332	Procmon64.exe
Token: SeDebugPrivilege	2636	Procmon64.exe
Token: SeLoadDriverPrivilege	2636	Procmon64.exe
Token: SeDebugPrivilege	2916	Procmon64.exe
Token: SeLoadDriverPrivilege	2916	Procmon64.exe
Token: SeIncreaseQuotaPrivilege	4628	WMIC.exe
Token: SeSecurityPrivilege	4628	WMIC.exe
Token: SeTakeOwnershipPrivilege	4628	WMIC.exe
Token: SeLoadDriverPrivilege	4628	WMIC.exe
Token: SeSystemProfilePrivilege	4628	WMIC.exe
Token: SeSystemtimePrivilege	4628	WMIC.exe
Token: SeProfSingleProcessPrivilege	4628	WMIC.exe
Token: SeIncBasePriorityPrivilege	4628	WMIC.exe
Token: SeCreatePagefilePrivilege	4628	WMIC.exe
Token: SeBackupPrivilege	4628	WMIC.exe
Token: SeRestorePrivilege	4628	WMIC.exe
Token: SeShutdownPrivilege	4628	WMIC.exe
Token: SeDebugPrivilege	4628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4628	WMIC.exe
Token: SeRemoteShutdownPrivilege	4628	WMIC.exe
Token: SeUndockPrivilege	4628	WMIC.exe
Token: SeManageVolumePrivilege	4628	WMIC.exe
Token: 33	4628	WMIC.exe
Token: 34	4628	WMIC.exe
Token: 35	4628	WMIC.exe
Token: 36	4628	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4628	WMIC.exe
Token: SeSecurityPrivilege	4628	WMIC.exe
Token: SeTakeOwnershipPrivilege	4628	WMIC.exe
Token: SeLoadDriverPrivilege	4628	WMIC.exe
Token: SeSystemProfilePrivilege	4628	WMIC.exe
Token: SeSystemtimePrivilege	4628	WMIC.exe
Token: SeProfSingleProcessPrivilege	4628	WMIC.exe
Token: SeIncBasePriorityPrivilege	4628	WMIC.exe
Token: SeCreatePagefilePrivilege	4628	WMIC.exe
Token: SeBackupPrivilege	4628	WMIC.exe
Token: SeRestorePrivilege	4628	WMIC.exe
Token: SeShutdownPrivilege	4628	WMIC.exe
Token: SeDebugPrivilege	4628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4628	WMIC.exe
Token: SeRemoteShutdownPrivilege	4628	WMIC.exe
Token: SeUndockPrivilege	4628	WMIC.exe
Token: SeManageVolumePrivilege	4628	WMIC.exe
Token: 33	4628	WMIC.exe
Token: 34	4628	WMIC.exe
Token: 35	4628	WMIC.exe
Token: 36	4628	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2332	Procmon64.exe
2332	Procmon64.exe
2332	Procmon64.exe
2636	Procmon64.exe
2636	Procmon64.exe
2636	Procmon64.exe
2916	Procmon64.exe
2916	Procmon64.exe
2916	Procmon64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3120	3012	msedge.exe	107
PID 3012 wrote to memory of 3120	3012	msedge.exe	107
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 2244	3012	msedge.exe	109
PID 3012 wrote to memory of 2244	3012	msedge.exe	109
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
"C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 460
  2⤵
  - Program crash
  PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1916 -ip 1916
1⤵
PID:4496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2636

C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
"C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 460
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3880 -ip 3880
1⤵
PID:3540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9a0a946f8,0x7ff9a0a94708,0x7ff9a0a94718
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

C:\Users\Admin\Desktop\Procmon64.exe
"C:\Users\Admin\Desktop\Procmon64.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Users\Admin\Desktop\Procmon.exe
"C:\Users\Admin\Desktop\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1236
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\Desktop\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2636

C:\Users\Admin\Desktop\Procmon.exe
"C:\Users\Admin\Desktop\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4312
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\Desktop\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2916

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1536
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

26c380f7-89c6-49ec-9ef2-d0587899179d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26c380f7-89c6-49ec-9ef2-d0587899179d.tmp
Size 873B
SHA256 f5c3264f7740848364c0f3282f7c372c2f2e4a3dd09cfaa770dbde7434c3dc8d
MD5 65458cf3d8f9b473d4c887e3eace5583
SHA1 faba979e2444df15607c5ee0ca49e86d9a397871
SHA512 03a90bf6a01ad61c8a11041175ea52f2c239b78a1ff9a20788239876610f4b2a75cc955172961e06ac35e8ad26bbfb660e0cbac73bf9b23aa49caa820893e5d8
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 47KB
SHA256 939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e
MD5 0d89f546ebdd5c3eaa275ff1f898174a
SHA1 339ab928a1a5699b3b0c74087baa3ea08ecd59f5
SHA512 26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690
SSDEEP 768:PmBTKtfz6S9DqfgrKfZDyjFUu3MR3wXRXIm1IH3z8V0RyWSOGQoP6tJUSSCGWi:PmtK5FpLrKfNyjFUua3+IX80RyWe3ytA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 70KB
SHA256 cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c
MD5 3b06aa689e8bf1aed00d923a55cfdd49
SHA1 ca186701396ba24d747438e6de95397ed5014361
SHA512 0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed
SSDEEP 1536:X1jcbykc2A3Iavx+p573hlckwkgYGs4Az13FtNVsesKvyJZA8YsB6jUhmXIFaNe:xcbAZ3BvQppRlckwpYTp3FHGGEA8t6Kj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 26KB
SHA256 303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709
MD5 8ce06435dd74849daee31c8ab278ce07
SHA1 a8e754c3a39e0f1056044cbdb743a144bdf25564
SHA512 49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59
SSDEEP 384:OmVT1b/1mCn9IhwacXe3opu6FDZaXGtxCTkzu61w7QGYNBx6PjVQRZnOfZJ6hU0U:x1ZFn9IhbcYD4DZagmkvAQGYN38W+hOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 077102c22673aeb738df2950f4d50753ff9ebe507e3a16c741d2e67b91ec4c3c
MD5 47b7dd7249f791838cc00baefc307ee4
SHA1 bb902d0e6178e4d04e5178e63782473016f79a35
SHA512 13102003a078848426254a9b1a3e744f7da1922b637b9584f7ed99736601e940c33c089fdccce77e8eab582fa3e19a2b1282dd602e0d308967508fcb801a4c39
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 881B
SHA256 e1d0cde1abcc7c898d770e7e173abb27b220c4d7c8b7f6ff6034fb573f4c6fc2
MD5 c7af02502b7aad75bbc72e6528d19fe3
SHA1 216ca21be43db6a452fff745d52ddb7cdc68d212
SHA512 b4457b0b38db4b7efef95200a3995cbe6cb8fcebb90d70747f2e5d311001372014359dd0ad6965819b35e69040d3e5795721ce388b8efec7fedf0d53e6a77b59
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 881B
SHA256 7f078a99d86ab846676285b56023cd99929c2fa1315be2638d318f7fbd83cc9e
MD5 e7333c997eba7babc60c0fc9cc41d551
SHA1 085ce3f451a7e359568235e6df5a8ffa1a597c1f
SHA512 9dcd7c215b8855998b29d21d31ba8d632395581e375a15e8be1a3a81922ad56296a443feb9fff60bd9943c32cfab2b3407f74a524c14484349bd39cbdd8a30d8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4687f6e65eaf5ce91b465fed0d42d37dd999d04ff8c4d186e4c8981ddc513daf
MD5 69965ae2d1a3452a254a1f4b8f122024
SHA1 93f47e6860aaf21a42ab7983bc7ef76980e632a3
SHA512 fa4ee8972b634af479ff075ef0542cf26d98389a974294311e0e652ea8d813ce0bf9e622ae2ffed20b1d012904902f2c9d88811d9996def2d9760701d756928c
SSDEEP 96:nFkUr1daSwpvWMoiVmdeHBjshUWQyV+VDCziEwb:nFk6/BGWMXB0ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5a32c27d5d65714295fa281bc9eed22e21e8a6abbe2e5aafe6a3e5db5b688c5c
MD5 523e4fe2c5ec60197e15c88499c4a6c7
SHA1 69e1a9ea57af01a658d6c0fe3d18a792f278ef21
SHA512 ee19d4dfaefb50cb753982006c07957208fe2391f010bb7c62ef40ac78e1415ae6d5ec20aeb4a47f40cd58a2fa3dea4051b0536b4842414065d87d68cdae3f6e
SSDEEP 96:nFkxr11KSwp3NlWMoiVmdeGuX1jBjzhUWQyV+VD7AiEwb:nFkBzxobWM2uXhB5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5160a3ed2fd2383251a279c234aa6a636cfb3ea61051bcbe4566b9242c7da5a9
MD5 93f5e790051c5b62babba40ee887688d
SHA1 df154fe901c0ffb47830627b2fe6d3a9d585df4c
SHA512 985066ec3463ff6410e92ecbc6b6818920f23a957f0992423dad6648b175fec1ab05677674ff909fa447371edf59204e3409fec17e58bf7074f06ee403a4131f
SSDEEP 96:nFknr11kSwprfjWMoiVmdehwpIjNBjshUWQyV+VD7AiEwb:nFkrzTAbWMRwGpBkrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c496977407ec204f090cc95000b4353712de6028fa99e228f9fb46787d7f2535
MD5 c7e57fdc0d8607c1ca930a4a4007b4e7
SHA1 6789b62b2cd2513c09fe6ac5f0a5badb6e51b465
SHA512 c30e522f2445e7ea7cf2b2d3dc9bdfd8289b4681b10f032e06ea2b67c1bbb790744d018f0eee24618fe0f1c4247a552b62704fe87565a81f1361ffe1804ca1bc
SSDEEP 96:nFk8sQ4r112SwpHftWMoidWR5mdebtXEOft7j6hUWQyV+VD7AiEwb:nFkNz9sVWM8ptXXV7Org
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1e9f5739741ff0816c9a012d4c945988db01879402eda260a2f5e8a17f70cd83
MD5 e7c2347221e0c138377eb873c6e3c14a
SHA1 c4e04176ccc6aadd074a991a87dd28fe8f8a35a0
SHA512 95ec77289dc9a7521820cc5a6bc805a29c9e5abce36fba868e545e7e57a72dc8bf03553b3dabec1c86dc44248cf7bd6d2987fb7e7d0448b6156de563b2605505
SSDEEP 96:nFk8sQNr11qSwpvWMoidYR/ROmdebtXEOft7jr/yWQyV+VD7AiEwb:nFkezRGWM+NWtXXV7Xlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 dd3ecf384d876b2b288a3aaaa3a7a07e7e835a13c0f111533d1843335aec8e5a
MD5 5192c1118a15daef4c177fce71b86d1c
SHA1 a91e16ecc2697fd3ecede1e9295e30fec0f12781
SHA512 91180cad2f51502e1b3d5a39ede01e2c9805882cf64210eb8851e9d60475bcef242849bff1cff9acf4807545308681df7e7666665aa81a43dcc044699ea68cff
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 787b84eacae1b0220a0e92d1860a6ec15259ef019ec056059ed23c165613a441
MD5 99be018eb0158fea60a31b58269f7a18
SHA1 633436c1b8e58a93e3e6b5ae4241a245177f245d
SHA512 50ea7a6a1e19d91c1a49a5598c2c2dd5470f51d9d7a76f5e608ac13dc87f3cdd4fcb3234a019e559ed21b8143e8329302b172d52887e24cb6949a282d0a5bacc
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 871B
SHA256 2fc22dfb78e9990d98a5a38258a789a25122ec0d74935999c09c5911c6741eb0
MD5 a5ffedcf0fa8523b68a534537cfdd717
SHA1 71c15d0555f963cbcb619c5bd62e886b968f6e1a
SHA512 7f651ed22d4830ecedd4456021859b986a7e33954f455d46be8ba22c6a7675b67275c2cc89f236d6416ade60438f2ea1e9b6755412fd07e499f064cea665d266
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 dbc21faffd82797028a8a53ad5780d9e2385d88d40a41f9b1b70d89b25c644fa
MD5 90c6eabe1f1ca457066cea0a3aa1ead2
SHA1 cd6aef095e220d73b3be00aabff1c51e5804577e
SHA512 e162ceb9d7f4a56c34be5f849efe8495a21174cf9d117764805aa94bd68b46b62d67dedce9fac28d0a53145439ae40edc7fdf030c1beceae3305d87ddfdc3260
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5a2348.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a2348.TMP
Size 534B
SHA256 992ed14ca070147cc9b6a82a8d75a9085f1ad349e489971f7a36523a8bb19c88
MD5 f2c40b0d8bae0ea43f5d99a8c2d7844f
SHA1 db3e07bf58d8d21a94c5a50aeb93f68f7b8915b5
SHA512 22f75902e75afcb7bcf6c176a908e98d4e835ec060c1245f0cc5a9b93aca96bb4e6a64124084311a01f9fc47ebfc51a279dda80cbf08d6b3e0cb96db2ceb6ec5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c6cfa5f8eb26fcbab6e3aa915d6ad853b59a31026f36e3a3da867f8e10f92ecf
MD5 645177b06ddb2fbf79ab49aefe25f610
SHA1 e4fd6ed8045f715b6839fc8728045202409776e6
SHA512 d65199a18df1054f76b6d2e09fce598cdab2d2c842951ca1c15cebdc090941c70b451bc7b03b6a4bcb6a030ee1002e789b17fb541c5a5eb0a3c38594b7290c37
SSDEEP 192:xoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/bR2RUhXEcgv7Ehje+vYVB:t9iIxuERzA83h09RZxYMvZ7IjeFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 677555a4fb05b060983c871b1eb892ad313b342e932cf789e3ba7d9028340b5e
MD5 d095006f5861b63cac97bf6bc7fddcd7
SHA1 57818ca4b9a82b40c2d19ca731922eb6f0fded36
SHA512 8d796983f8f1a135370716186f02f386a416e53040bd8d22a6aa1057d51153e4a39eae902273077a8e1a7f04c6d7d979f05b18abd51c1650c7db3f015d6a8755
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprbR2RUhlchk+vYVkDu:A9iIxuERzA83h09RZxYIZkFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 af2c145f89ca7ab4735566dc6463b1f1ebe1bc588bddf80ddf0abac1acafaa1b
MD5 ab9dffd7fdc46a14105b5a0da166408d
SHA1 0c289b25fea18b51f5b4a536f247b2b332ab6101
SHA512 bc3fd98a1571fe74904d9e3de951ec5bf6ff1829f1a3289f58b5e7d66ab5df091f6116d47ef51dd08b725ffa8d3c2c7f8ae5f31d9451dba44b0d40c653880e8b
SSDEEP 192:IoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/bR2RU0ePEcgv7Ehfe+vY7:w9iIxuERzA83h09RZxYMgcZ7IfeFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

Procmon64.exe

Path C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
Size 2.0MB
SHA256 3e15995894f38b2eead95f7ff714585471f34f3af3d8f50a7f83344781502468
MD5 223b222ce387a7f446d49a1ee9b572bb
SHA1 8ed888a02861142e5eb576385568c2ba0ddd8589
SHA512 037b4787af5fb129a3b1e0ac9565e59d5a55ef26ccf93bc9adf685c08422071ee0d0eb4667cd2ce0d725c7dea0209c1d7d48baf58cd18dfb58de35bf7feef1a2
SSDEEP 49152:LNvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCw6IxKX:ElmzSzko2zjCf9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProcessMonitor.zip

Path C:\Users\Admin\Downloads\ProcessMonitor.zip
Size 2.9MB
SHA256 d4ed579fdc1957fde0124dd41efd8d72af0529254984bfa5a3864ecd8b539252
MD5 213d09599b9761a8e78c20b3f8072636
SHA1 815ae249e5dc5bcdd8576ff29d3ec39e20c761f7
SHA512 f656e128fcb0269946cfa03adc5392676c17b18f309e0476b2153fe545e4d92641e7849b94743e84fce39366b0b72f04e725b7922ccf513deaba8aef833ad971
SSDEEP 49152:yy1XnFuU2MRIc/YSse+L+xUgwQuzadKyt8XUHNn1IDNLrDPhMvK2cQEKIs1wZ/mN:z1XA1/V/FL+W76KYNHNn25ThR25EKzeA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1180-21-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-19-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-23-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-17-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-13-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-12-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-20-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-11-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-18-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1180-22-0x0000020320F60000-0x0000020320F61000-memory.dmp

Download

memory/1916-4-0x0000000000400000-0x0000000000819000-memory.dmp

Download

memory/1916-5-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1916-1-0x00000000009B0000-0x0000000000AB0000-memory.dmp

Download

memory/1916-6-0x0000000002550000-0x000000000255B000-memory.dmp

Download

memory/1916-2-0x0000000002550000-0x000000000255B000-memory.dmp

Download

memory/1916-3-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3880-8-0x0000000000400000-0x0000000000819000-memory.dmp

Download

memory/3880-9-0x0000000000400000-0x0000000000819000-memory.dmp

Download