darkcomet | 4c8e398a92df2220c894ae9c29cbdde3f17d9ec8d98ecad1bfefae11689395b4

Resubmissions

06-02-2025 15:09

250206-sjg1lazqam 10

31-01-2025 12:44

250131-pylqjswkbw 10

Analysis

max time kernel
777s
max time network
542s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-01-2025 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LiquidBounce 2025/Liquid Bounce Injector.exe
Size

349KB
MD5

1166bb4123351851bd9a283654a51cf2
SHA1

2c53441f4df33453c26474fc3a01815d466b7ac6
SHA256

5dc4cef5041077ed2feef605b9db580efe0b3bcc86823aef08ab3da19c5e8797
SHA512

c62b8c3bf41ca424fe2e5e37057bae1273d533270e52a11e72aca3a35c67fc90fad4aaeb92317fe4c72e7480ebed14e5e9099f254a1beb24fe1c9c4131b86687
SSDEEP

6144:XcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37Jeb:XcW7KEZlPzCy378b

Score

10^/10

darkcomet guest16 defense_evasion discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

j4n6foy.localto.net:2596

Mutex

DC_MUTEX-1R3S01Q

Attributes

gencode
k7nfzKERaShh
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2566122449-2538968884-464987429-1000\Control Panel\International\Geo\Nation	Liquid Bounce Injector.exe

Executes dropped EXE 1 IoCs

pid	Process
3296	Liquid Bounce Injector.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3416-0-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-2-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-5-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-6-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-8-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-9-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-10-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-11-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-12-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/files/0x000b000000027ccd-19.dat	upx
behavioral1/memory/3296-30-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-32-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3296-33-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3296-36-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-37-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-67-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-166-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-590-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-591-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-630-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-775-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-806-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-807-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-808-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-809-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-810-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-811-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-812-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-813-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-814-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-815-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-816-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral1/memory/3416-831-0x0000000000400000-0x00000000004E8000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5488	1152	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liquid Bounce Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liquid Bounce Injector.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133828012251921128"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2566122449-2538968884-464987429-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2566122449-2538968884-464987429-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\U:■║5wΦ±╖Ä╙┬╙ì÷{	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
232	chrome.exe
232	chrome.exe
5264	msedge.exe
5264	msedge.exe
4328	msedge.exe
4328	msedge.exe
4320	identity_helper.exe
4320	identity_helper.exe
3416	Liquid Bounce Injector.exe
3416	Liquid Bounce Injector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
232	chrome.exe
232	chrome.exe
232	chrome.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3416	Liquid Bounce Injector.exe
Token: SeSecurityPrivilege	3416	Liquid Bounce Injector.exe
Token: SeTakeOwnershipPrivilege	3416	Liquid Bounce Injector.exe
Token: SeLoadDriverPrivilege	3416	Liquid Bounce Injector.exe
Token: SeSystemProfilePrivilege	3416	Liquid Bounce Injector.exe
Token: SeSystemtimePrivilege	3416	Liquid Bounce Injector.exe
Token: SeProfSingleProcessPrivilege	3416	Liquid Bounce Injector.exe
Token: SeIncBasePriorityPrivilege	3416	Liquid Bounce Injector.exe
Token: SeCreatePagefilePrivilege	3416	Liquid Bounce Injector.exe
Token: SeBackupPrivilege	3416	Liquid Bounce Injector.exe
Token: SeRestorePrivilege	3416	Liquid Bounce Injector.exe
Token: SeShutdownPrivilege	3416	Liquid Bounce Injector.exe
Token: SeDebugPrivilege	3416	Liquid Bounce Injector.exe
Token: SeSystemEnvironmentPrivilege	3416	Liquid Bounce Injector.exe
Token: SeChangeNotifyPrivilege	3416	Liquid Bounce Injector.exe
Token: SeRemoteShutdownPrivilege	3416	Liquid Bounce Injector.exe
Token: SeUndockPrivilege	3416	Liquid Bounce Injector.exe
Token: SeManageVolumePrivilege	3416	Liquid Bounce Injector.exe
Token: SeImpersonatePrivilege	3416	Liquid Bounce Injector.exe
Token: SeCreateGlobalPrivilege	3416	Liquid Bounce Injector.exe
Token: 33	3416	Liquid Bounce Injector.exe
Token: 34	3416	Liquid Bounce Injector.exe
Token: 35	3416	Liquid Bounce Injector.exe
Token: 36	3416	Liquid Bounce Injector.exe
Token: 33	1992	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1992	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	3296	Liquid Bounce Injector.exe
Token: SeSecurityPrivilege	3296	Liquid Bounce Injector.exe
Token: SeTakeOwnershipPrivilege	3296	Liquid Bounce Injector.exe
Token: SeLoadDriverPrivilege	3296	Liquid Bounce Injector.exe
Token: SeSystemProfilePrivilege	3296	Liquid Bounce Injector.exe
Token: SeSystemtimePrivilege	3296	Liquid Bounce Injector.exe
Token: SeProfSingleProcessPrivilege	3296	Liquid Bounce Injector.exe
Token: SeIncBasePriorityPrivilege	3296	Liquid Bounce Injector.exe
Token: SeCreatePagefilePrivilege	3296	Liquid Bounce Injector.exe
Token: SeBackupPrivilege	3296	Liquid Bounce Injector.exe
Token: SeRestorePrivilege	3296	Liquid Bounce Injector.exe
Token: SeShutdownPrivilege	3296	Liquid Bounce Injector.exe
Token: SeDebugPrivilege	3296	Liquid Bounce Injector.exe
Token: SeSystemEnvironmentPrivilege	3296	Liquid Bounce Injector.exe
Token: SeChangeNotifyPrivilege	3296	Liquid Bounce Injector.exe
Token: SeRemoteShutdownPrivilege	3296	Liquid Bounce Injector.exe
Token: SeUndockPrivilege	3296	Liquid Bounce Injector.exe
Token: SeManageVolumePrivilege	3296	Liquid Bounce Injector.exe
Token: SeImpersonatePrivilege	3296	Liquid Bounce Injector.exe
Token: SeCreateGlobalPrivilege	3296	Liquid Bounce Injector.exe
Token: 33	3296	Liquid Bounce Injector.exe
Token: 34	3296	Liquid Bounce Injector.exe
Token: 35	3296	Liquid Bounce Injector.exe
Token: 36	3296	Liquid Bounce Injector.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe
Token: SeShutdownPrivilege	232	chrome.exe
Token: SeCreatePagefilePrivilege	232	chrome.exe
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	2540	firefox.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
4328	msedge.exe
4328	msedge.exe
1152	wmplayer.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
232	chrome.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3416	Liquid Bounce Injector.exe
2872	OpenWith.exe
2540	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3296	3416	Liquid Bounce Injector.exe	86
PID 3416 wrote to memory of 3296	3416	Liquid Bounce Injector.exe	86
PID 3416 wrote to memory of 3296	3416	Liquid Bounce Injector.exe	86
PID 232 wrote to memory of 4488	232	chrome.exe	92
PID 232 wrote to memory of 4488	232	chrome.exe	92
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 3848	232	chrome.exe	93
PID 232 wrote to memory of 952	232	chrome.exe	94
PID 232 wrote to memory of 952	232	chrome.exe	94
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95
PID 232 wrote to memory of 4404	232	chrome.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LiquidBounce 2025\Liquid Bounce Injector.exe
"C:\Users\Admin\AppData\Local\Temp\LiquidBounce 2025\Liquid Bounce Injector.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Roaming\Liquid Bounce Injector.exe
  "C:\Users\Admin\AppData\Roaming\Liquid Bounce Injector.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x488
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffce117cc40,0x7ffce117cc4c,0x7ffce117cc58
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1980,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=2296 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4620,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4840,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,15076527046907155568,13422263534412453690,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:3644

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1864 -prefsLen 27199 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0d8dc78-99d2-43a2-a839-090bdf8bd3c8} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" gpu
    3⤵
    PID:2476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 27077 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66946bc3-f05b-41c0-82b9-9574d3b45e3a} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" socket
    3⤵
    - Checks processor information in registry
    PID:3180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 3240 -prefMapHandle 2988 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f317c9ba-b2ee-4c05-a002-46dcf94e45d1} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" tab
    3⤵
    PID:2664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3352 -childID 2 -isForBrowser -prefsHandle 3772 -prefMapHandle 3432 -prefsLen 32451 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a22337a-d6da-4407-9d94-900fa9b21739} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" tab
    3⤵
    PID:4680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4656 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4740 -prefMapHandle 4728 -prefsLen 32451 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ee58819-1e6b-4391-a8c5-29a635a6ce08} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" utility
    3⤵
    - Checks processor information in registry
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 3 -isForBrowser -prefsHandle 4936 -prefMapHandle 4952 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6b1f6a7-d702-4d9a-a91f-9df729e2708c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" tab
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 4 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {523fefc2-457e-4f99-ac8a-4a3bae32eb5c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" tab
    3⤵
    PID:5908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5512 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd591aba-0c3a-452d-bee5-62682b72708e} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" tab
    3⤵
    PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ReceiveCopy.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffce0f646f8,0x7ffce0f64708,0x7ffce0f64718
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11238529187999396606,4076904100397793271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5980

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1152
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3552
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 2856
  2⤵
  - Program crash
  PID:5488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1152 -ip 1152
1⤵
PID:5380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\StepExit.cmd" "
1⤵
- NTFS ADS
PID:4956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1f09e489c5deefe9378c76ff031fb95f

SHA1
e4497e7a8cf27c30060c58ea5255ae47e3705bfc

SHA256
7dd0b078c88b464c645d1dd99073bec90ff4eabae9aa7efeb5da84b344d37d20

SHA512
6304daa45ccb0b2809f54fd0a5c134a584588818e4c5157c50850dcf5f4e4762121a6660130cdb616b5c06e03ac2981aaca7ab4d3a3d8865a5cbe7ffa1a40744

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
e96ff20dc6002b3acf1ddef1618dc110

SHA1
a45d65a603162b3433b6dff0ace08424944302f8

SHA256
5362d8b7001169d7c4adbab8873c1c67f528e2b8752d1677cec5828587bf8975

SHA512
7ab7f509c76cdbfaed2d6bb87b94dbb8be4d06d5451a05efc724c55cfc92599fba0ff1825bda7e997b7808b10a057e6b106f334d819bec866949613830321c04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5c0174304f37bdbd8158c0a3ea5cc294

SHA1
a96cd6380f2756a479c2c6229859920d021173a0

SHA256
1689eb91f14041f27f453bcbca785081239946462bc8a9a7a124d5a073a15417

SHA512
cc4ae8a0aeedbb1fc899d2e6e1e536a1d505eb6e4920342f6de4379245f37e4cf8700c3e05849047eaa01b502f3b502d73415f3fc4dd4b3d150085c897fa69cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f2d1c6e665c501593bf33f5dfabe86f4

SHA1
2c6f9a432f9036fdcd77afaf1b8c6e2244c3b84a

SHA256
96188067894056a09c467b65053b8a7d8dfc84c45aaedac9246167cfe35ae586

SHA512
95b160364442990288045ff5dae6c2583c9a15c84369461d94e33b2fa18d0256ece4a9d771106e6311de1da5f5a9c0fb8ef8c8764ad0f5d1f1a6979f27970a56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
122KB

MD5
41635636bdbf6236220c27be5af2012b

SHA1
54f6ce5d4caa0ca3448a9923edc0184a8c5a4cf2

SHA256
46d6253c448f269ca73f01f80eb8a817e3de7e90c533c86c44e8d1781764e873

SHA512
66a1314ac55d0d737076da41c2eeff9a72f06924d95573890002c759f52c1abb840126f542c8c1a14487ce26edfb7ce5260a00c2b140d7e41e5e3ff1068ee849

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
243KB

MD5
57d7072266c348bf7d840b67f543faf1

SHA1
7c5910330c73a6a9a0c00c82d787ad6866033f96

SHA256
2f2e5fff12e9ecab26105be5ac085c40408fdb0dd2889ada48e8097cb5bf7427

SHA512
65c3b9f497b89b81067e58d3f30f75b37b53ae9f802c4d0281cc328199a67771c2f97e00e437aff6745b9f35cbd22f035e5e47443d83057ddbf840ad4d7d5515

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8fe50664fd38239e8c01b75122cc6b3d

SHA1
36d011ccd6e5ce47ad0e69559c782d6482e6cf4c

SHA256
c7be861be90fd1a2b4df96b30c8b39739d99f945f79d21bef4eb7481358bfb0a

SHA512
f96af6111881853330c9c8816a354faf8946c97cc56e04b0de9a764a40f4541dd4b59c82a8db8c243f059c386e680f8c1f010c34f6da0cdb6fb1fa4de81afd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07a6ba86e9a9b8f68a9d15d0744a52b3

SHA1
5382ebeae5dfa8ef7aa879e312640591b1a2c2f5

SHA256
32c3a87f573e1368477a104eb1b063f59e91c12fe104a7f0e6d5918330b86468

SHA512
d535e602514652d7d55b93ce00fea8cc500f65fbc1cafa18a1387f071fe07227b27855032cd0277d2623d5b802f062283df161704aab68175fe171648444362d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36285383559af32f53abf789d6844ca3

SHA1
679e0e149e1c5983b07b8105e47eeaad5c293ea3

SHA256
803081108ad7f6706f8d9905c8ffef0bbf9c01e27253c8a0e7feb007cde4e6f9

SHA512
821230489ead3ad739c80265bf8ed3981869afb4a21ceea54869ae13c60c8644c407aa3be7c1518b39fb89d1855205b36d34f022d1fad8ed7bc1fcf19f583e95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9916595e42c060c849f2764ec3f7ac87

SHA1
4272a9cc38bbcf96a5bcfaf29b4cfd6f2831bab1

SHA256
dc8e3cb64e4da9a5f7aa6bcc63f8d3669e6bfe6cbbc04239ee37bc708cedf36d

SHA512
7024068caab366bcefac6d5d0bb15346fc636753ddabe51e9105fb4c81b4ace304f3fdb51449f00bec3e70fdd62aad5fc612cc40964f7a686a8bb0f17117c227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b525f58520a1eb1c712238e64e3769e

SHA1
b7c59b36a09c5a74439581049e5167ef1885b6f6

SHA256
dd91a04814f5da46c532ac9c65e72783fd2c54fa4881756f073382465e8f5da7

SHA512
1c5e2837b429bb83e487dcc33142d88c9f3b224389c5afc67c77e5904b447b87c7e206d69d9f35386e3ad9ad1ceff159d4486eb64cefc854a6fdd1f17a01429e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9dcce69f034b900ce72271c3bfdd2c62

SHA1
7bb676b9c3cc998faf454479e5896cd06a078897

SHA256
e8e0f4f2cfeadd921486d8a8d0d3f5d559ef61bda9929cd781a1e5b9bb56cb6e

SHA512
91c360c3664da223b2b306fe8d3b793270196a8f415786cf84e0eb04681adbadadb9355b9b26e243b3d542bd603e5787d4939a3911888b1fa823364159681e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
d77ecf28ef6d06c2344889429ccd15b5

SHA1
67f4f6709d4a697477e8afd81ed824a251f1325e

SHA256
723fb5686f25f6edcab0719f6aa6bd331b861addc6710de1e722669e7e5288ed

SHA512
1331c3886c4f3fe671611d3f4bc1e1f7679394b913f723bd5bb35d852f83adc064dcb1511547ffed1cdf746d0358805415db45aa6570996b777942b5189a0764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
113f51876f60f1982bc4a8119cb36a22

SHA1
2324eae07f652dfa79144fbe5b65bbf871bc80c0

SHA256
5c32d01733249111f28b01e2111d1c99c3dc301f6c0551de646ac9139eda3459

SHA512
fa03ca6c54ce0b0ebeff1fd74ea302c98e2d91f585fefaea1fe6bcfca8a617676982b87680425a50488a1a934144c1eefb4a42f42c654e1ec4f7848639c40fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v3ll07dd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
17c29327f0d77d7dd70d1822e10de6d9

SHA1
dada04ea0e7a5bfcfe76f1309832eea095cc51ce

SHA256
0c45f6ad4af5b1d4e1e207dec2ddd518dfdbaf1f1684edf184ccaef419ee30cb

SHA512
3a26d84aafafb86fd76eaf6bfec832ffea8030798e80ad78afd7362052502a994415cbd868e6c0539c5071be43623c08029be46f2542c65efb7c7121e3efb4f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
cc92638c2c6bb7390628d39dfddf50b8

SHA1
c9357c02e670d802a76a835e08e87cf8b2185599

SHA256
021f9818902539e3f1436659ed6d56fb4a5b4a4c95aeb17c0eab3b9932dab58a

SHA512
2e1ae2ee3b02ee2756466630850ae8380b6f7176d61ad3016ec8bc58a2b1b3e73f37f4feffd6f5e87694c7555678c53590b3fd36bbc0649be6ef6587f3cfd0ef

Download Submit
C:\Users\Admin\AppData\Roaming\Liquid Bounce Injector.exe

Filesize
349KB

MD5
1166bb4123351851bd9a283654a51cf2

SHA1
2c53441f4df33453c26474fc3a01815d466b7ac6

SHA256
5dc4cef5041077ed2feef605b9db580efe0b3bcc86823aef08ab3da19c5e8797

SHA512
c62b8c3bf41ca424fe2e5e37057bae1273d533270e52a11e72aca3a35c67fc90fad4aaeb92317fe4c72e7480ebed14e5e9099f254a1beb24fe1c9c4131b86687

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
52079df568e2b475845be013404f0457

SHA1
0d2f29daf9c571056e4d8ef0a8858c5451076c3f

SHA256
09c113d6dceb4f1f056546543690d58fba532688aeed95c5d2790548d4f59ea3

SHA512
abcffc9192b5344a55d608b7c8494abbf4cdb32c19812aab3b3b9a0602a08a42a42bc67bc367c0da967a0546302c90d30aacbc3c4479afa64919f0ddc4fd6698

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
c95a4762b29c8f8b3451f90cda1cf19d

SHA1
2b455cdf046389ac200d84a4fd4febadd78beb46

SHA256
594075f66b252e85d64e54e51bb1ac09180cb5e7d07c804189018987a498dc04

SHA512
c7bb9ffb4d7ea8b77e12641fc320572976aeba7477e5c67b91a7601edbbdcc2eb5fe1a320b304a00fc86537eb184cdf7eac1123ee86deaebd76b9547e709d9c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v3ll07dd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
fefde386bf2192356bb615fdb335dcf3

SHA1
edb77dd8792b42fa24a75c2b99fcc4e5f1edc988

SHA256
b832bd4f18dcc71897371c3d309fb0d5ae0fdacf6d03fa97547738f1831ec927

SHA512
9e8565e561a9450972c9e88776e42a00fd92bb308dd09925047c8a96d8128c03fd89a8801dddee1551fc25687286e103eea75bd4286e1c0f29309eb720a75d34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v3ll07dd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
28fb099983809a6ea852b50dde8b2f08

SHA1
f8dc98ddac735559a621fc411ae1f1b1651e1501

SHA256
b769f2625fbf1c0d3d979eb810305e9e55f4580beb283762849f50d4a4d07745

SHA512
a00498246671d810f00fa4e57b89be1c557f35607fc6656bd87a881c5010e4f31cd155148eefc4483f6b7da9bd5073151931cdc3ffb6a2e2e24e69acedc680de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v3ll07dd.default-release\datareporting\glean\pending_pings\5b7a548b-915f-41cf-b985-45f76c09b79c

Filesize
982B

MD5
c1a3720f7f2427034d19948b25fad612

SHA1
db3a6da136c0590ea0978eef228d4bfc558e531f

SHA256
47c65be083aaa53d0b2a8c437d50f52685ee2d25d7b5a89b2f202d41ff0613a1

SHA512
46f5adf07072872de2a53f7ec87030d4af66e8fc9947ae7a376d83ea229b35187215ca62ba5dea1c70d4bce7a66ae64464b5101dea02d07ab0090d65b537b1db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v3ll07dd.default-release\datareporting\glean\pending_pings\a4c7b9c5-8808-4bed-96e8-c78111d4658b

Filesize
25KB

MD5
f1790bddf1562eb1717e6bfd97d0057a

SHA1
abd34c72041a1f3d3a8b2bb3108e8e076d527e1c

SHA256
d6a4697e36c37c134f1724f51ac8a810c77723175df83ff934f6a991f9df9761

SHA512
1e0a8d789fbd1fb5edf9da1a2cc7398915763b120e76d7d6787bfd0fe2ffb6519869e58d0809345341f7952c2891a5057695a5eafb2ec3bfe918a6c870e52a89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v3ll07dd.default-release\datareporting\glean\pending_pings\b5a7f5f6-3ae8-4c03-8338-dbe164583a1e

Filesize
671B

MD5
5d1c931c37ee5abe3db1fb919e941c16

SHA1
d253231e7fb84f8a353e8936e26073d4a2c0fc49

SHA256
6b91716b3ab1aa346a53f302d25d78ab61dc2f5408c08d70034ad01fd6516ff3

SHA512
ebcba402a3a3a16306d8b4cca7def4d4686d1da68eda88cbd2d25bfc46b4556cdb5fe8b5988e93c2e515106646e6b49795c4ef9e00a6673fc988d212412c73bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v3ll07dd.default-release\prefs.js

Filesize
9KB

MD5
c69c0429c9ff25cec9fc27bdabd33470

SHA1
e89b272939ad59dbc6f7f9b0fd411c73e8e438ce

SHA256
41406b4f65bfbd3f4e4e798b4f7b98d77c32dc6e83a451d54a7b551be7da7624

SHA512
40dc8e6a3b3dcdd6f2e718bbb1e27026aab78b554848b5dd959de4341ad7e0ddd9fe7c19de769c0c8fd8d6ab95c9213de70404d226476b31cb12aa3936723048

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v3ll07dd.default-release\prefs.js

Filesize
9KB

MD5
6c4cd5935fb359d6d8e4a759cfc6cb6f

SHA1
19620698261ddafc0b5b586d57f9dd8b363e240a

SHA256
a66a2c706ebe559eae7e3da3f55d9f7882893b755b19f597ea937aa8d6642a7b

SHA512
ee867f78ecd81543e9c88bd69dac71b4d1c119145135b7acca099f7e75e0be79a25be72be3e8460311f8cf77b3da3c6869a0f9de72db7e2a463fe4ff4799a5e7

Download Submit
memory/1152-785-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/1152-778-0x0000000008680000-0x0000000008690000-memory.dmp

Filesize
64KB

Download
memory/1152-787-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/1152-786-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/1152-781-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/1152-782-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/1152-783-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/1152-784-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/1152-780-0x0000000007790000-0x00000000077A0000-memory.dmp

Filesize
64KB

Download
memory/3296-36-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3296-33-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3296-31-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/3296-30-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-12-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-590-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-9-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-8-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-7-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3416-6-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-5-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-775-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-11-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-4-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/3416-166-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-630-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-32-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-591-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-10-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-37-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-67-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-2-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-1-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/3416-806-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-807-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-808-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-809-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-810-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-811-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-812-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-813-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-814-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-815-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-816-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3416-831-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download