qulab | 7921c12179578321423314c5458842e5f057609027c7b0a7fb4c072295ad8d6b

Resubmissions

25/02/2025, 02:57

250225-dfwbgszjs4 10

25/02/2025, 02:35

250225-c3cl8axpw8 10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2025, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Private_Cheat by pc_Ret v8.exe
Size

2.8MB
MD5

9f031ba9a4e474e8a87e16e49bf61bc4
SHA1

37f4299fb8888fd7bc477e659e50adac41c3f4f1
SHA256

7921c12179578321423314c5458842e5f057609027c7b0a7fb4c072295ad8d6b
SHA512

95218bbf2f905d791e7aca7d659eaca073f132e6380a2b0a4c152785653618cb919b5e3d0455c57094e99f414283b459c2280703785ace3a929a6c03235d1e5a
SSDEEP

49152:ah+ZkldoPK8YaMWS1/D+MRMOtjR/zTqny/f5ft1xSKHYS:z2cPK821/iMRhjR/zXR1jT

Score

10^/10

qulab agilenet defense_evasion discovery ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 25.02.2025, 02:57:49 Main Information: - OS: Windows 10 X64 / Build: 19041 - UserName: Admin - ComputerName: VETZEJGC - Processor: 12th Gen Intel(R) Core(TM) i5-12400 - VideoCard: Microsoft Basic Display Adapter - Memory: 8.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge - Microsoft Edge WebView2 Runtime - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Windows Desktop Runtime - 8.0.2 (x64) - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Windows Desktop Runtime - 6.0.27 (x64) - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Windows Desktop Runtime - 7.0.16 (x64) - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 356 - csrss.exe / PID: 444 - wininit.exe / PID: 520 - csrss.exe / PID: 528 - winlogon.exe / PID: 616 - services.exe / PID: 656 - lsass.exe / PID: 672 - fontdrvhost.exe / PID: 784 - fontdrvhost.exe / PID: 792 - svchost.exe / PID: 800 - svchost.exe / PID: 908 - svchost.exe / PID: 956 - dwm.exe / PID: 336 - svchost.exe / PID: 428 - svchost.exe / PID: 952 - svchost.exe / PID: 1044 - svchost.exe / PID: 1120 - svchost.exe / PID: 1136 - svchost.exe / PID: 1152 - svchost.exe / PID: 1164 - svchost.exe / PID: 1280 - svchost.exe / PID: 1292 - svchost.exe / PID: 1356 - svchost.exe / PID: 1384 - svchost.exe / PID: 1440 - svchost.exe / PID: 1560 - svchost.exe / PID: 1576 - svchost.exe / PID: 1664 - svchost.exe / PID: 1744 - svchost.exe / PID: 1752 - svchost.exe / PID: 1800 - svchost.exe / PID: 1892 - svchost.exe / PID: 1980 - svchost.exe / PID: 2044 - svchost.exe / PID: 1540 - svchost.exe / PID: 1656 - svchost.exe / PID: 1936 - spoolsv.exe / PID: 2144 - svchost.exe / PID: 2184 - svchost.exe / PID: 2232 - svchost.exe / PID: 2356 - svchost.exe / PID: 2500 - svchost.exe / PID: 2508 - svchost.exe / PID: 2652 - sysmon.exe / PID: 2708 - svchost.exe / PID: 2720 - svchost.exe / PID: 2736 - svchost.exe / PID: 2764 - sihost.exe / PID: 2940 - unsecapp.exe / PID: 2992 - svchost.exe / PID: 3008 - svchost.exe / PID: 3024 - taskhostw.exe / PID: 3060 - svchost.exe / PID: 3160 - svchost.exe / PID: 3408 - explorer.exe / PID: 3512 - svchost.exe / PID: 3632 - dllhost.exe / PID: 3812 - StartMenuExperienceHost.exe / PID: 3904 - RuntimeBroker.exe / PID: 3968 - SearchApp.exe / PID: 4056 - RuntimeBroker.exe / PID: 3536 - sppsvc.exe / PID: 4536 - svchost.exe / PID: 1060 - svchost.exe / PID: 5000 - svchost.exe / PID: 464 - svchost.exe / PID: 2140 - OfficeClickToRun.exe / PID: 3620 - SppExtComObj.Exe / PID: 2760 - svchost.exe / PID: 1840 - svchost.exe / PID: 4880 - dllhost.exe / PID: 1068 - svchost.exe / PID: 1584 - TextInputHost.exe / PID: 4868 - RuntimeBroker.exe / PID: 1688 - svchost.exe / PID: 5056 - svchost.exe / PID: 4388 - RuntimeBroker.exe / PID: 3508 - RuntimeBroker.exe / PID: 2800 - upfc.exe / PID: 1096 - svchost.exe / PID: 2008 - backgroundTaskHost.exe / PID: 4904 - backgroundTaskHost.exe / PID: 4192 - Baldr (11).exe / PID: 1200 - svchost.exe / PID: 1084 - WmiPrvSE.exe / PID: 4216 - Wpc.exe / PID: 2660

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab
Qulab family
qulab

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6020	attrib.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000500000001e4da-88.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	Private_Cheat by pc_Ret v8.exe

Executes dropped EXE 6 IoCs

pid	Process
1200	Baldr (11).exe
2224	Build.exe
2660	Wpc.exe
3760	Wpc.module.exe
5944	Wpc.exe
3484	Wpc.exe

Loads dropped DLL 2 IoCs

pid	Process
2660	Wpc.exe
2660	Wpc.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/1200-25-0x0000000000C00000-0x0000000000C46000-memory.dmp	agile_net

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ipapi.co
32	ipapi.co

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b000000023bc2-20.dat	autoit_exe
behavioral2/memory/2224-73-0x0000000000690000-0x0000000000867000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	Wpc.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	Wpc.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001e4da-88.dat	upx
behavioral2/memory/2660-87-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx
behavioral2/memory/2660-91-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx
behavioral2/files/0x000c000000023be6-123.dat	upx
behavioral2/memory/3760-124-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3760-129-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/2660-130-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx
behavioral2/memory/2660-131-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Wpc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Wpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Private_Cheat by pc_Ret v8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Wpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wpc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Wpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Wpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baldr (11).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Build.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wpc.module.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Wpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wpc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	Build.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\winmgmts:\localhost\	Wpc.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1200	Baldr (11).exe
1200	Baldr (11).exe
2660	Wpc.exe
2660	Wpc.exe
4616	chrome.exe
4616	chrome.exe
1608	msedge.exe
1608	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
5968	identity_helper.exe
5968	identity_helper.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	Baldr (11).exe
Token: SeRestorePrivilege	3760	Wpc.module.exe
Token: 35	3760	Wpc.module.exe
Token: SeSecurityPrivilege	3760	Wpc.module.exe
Token: SeSecurityPrivilege	3760	Wpc.module.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: 33	6096	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6096	AUDIODG.EXE
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1200	2452	Private_Cheat by pc_Ret v8.exe	88
PID 2452 wrote to memory of 1200	2452	Private_Cheat by pc_Ret v8.exe	88
PID 2452 wrote to memory of 1200	2452	Private_Cheat by pc_Ret v8.exe	88
PID 2452 wrote to memory of 2224	2452	Private_Cheat by pc_Ret v8.exe	91
PID 2452 wrote to memory of 2224	2452	Private_Cheat by pc_Ret v8.exe	91
PID 2452 wrote to memory of 2224	2452	Private_Cheat by pc_Ret v8.exe	91
PID 2224 wrote to memory of 2660	2224	Build.exe	93
PID 2224 wrote to memory of 2660	2224	Build.exe	93
PID 2224 wrote to memory of 2660	2224	Build.exe	93
PID 2660 wrote to memory of 3760	2660	Wpc.exe	98
PID 2660 wrote to memory of 3760	2660	Wpc.exe	98
PID 2660 wrote to memory of 3760	2660	Wpc.exe	98
PID 4616 wrote to memory of 3488	4616	chrome.exe	106
PID 4616 wrote to memory of 3488	4616	chrome.exe	106
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 3456	4616	chrome.exe	107
PID 4616 wrote to memory of 2564	4616	chrome.exe	108
PID 4616 wrote to memory of 2564	4616	chrome.exe	108
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109
PID 4616 wrote to memory of 216	4616	chrome.exe	109

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6020	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Private_Cheat by pc_Ret v8.exe
"C:\Users\Admin\AppData\Local\Temp\Private_Cheat by pc_Ret v8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Roaming\Z1004308289\Baldr (11).exe
  "C:\Users\Admin\AppData\Roaming\Z1004308289\Baldr (11).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Users\Admin\AppData\Roaming\Z1004308289\Build.exe
  "C:\Users\Admin\AppData\Roaming\Z1004308289\Build.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.exe
    C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.module.exe
      C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\ENU_801FE9737A5A456E9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\1\*"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:6020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb5137cc40,0x7ffb5137cc4c,0x7ffb5137cc58
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2188,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3312,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3740,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4868,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5092,i,13883795131493205672,8988370937599388341,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb4e1146f8,0x7ffb4e114708,0x7ffb4e114718
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,18340815046779056093,1715296358484561703,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5240

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.exe
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5944

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.exe
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
c9be626e9715952e9b70f92f912b9787

SHA1
aa2e946d9ad9027172d0d321917942b7562d6abe

SHA256
c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

SHA512
7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
e778a953bf0feadfc633a88f03eeade7

SHA1
76575f08bb06b8c7a84849072b260f3886aa6678

SHA256
60abac3c5fe5ff55735daf7b4c67390ceae4aed0dee5b8e6fc159d63315b9512

SHA512
23c845017ffa9da10c5abd3b58d51d67d91c83672e04d454cdec7d4dc5eeebb4c5056357a5dbb1114020c0ae5b38e76ef77ad8154ff88a60346b9dae1d98fe17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
f0e4c4f565a3c9713a55784ffad09f7f

SHA1
38e8ebac7d1d10d76f7ddff7bb29c1e61b71cfd7

SHA256
a6dfd02216927c148fbf3ca524d112a562c5417868414a404149931ce6de58b2

SHA512
8cec6aea340478ac837540d200f4741f9ac5ff873069b16ab6c04f582aeaf331cc79839d67017434110af73df9037a81f48ef9b012483ba5ffaae7df678d663e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
32b5ccb1918afe75537728e265804941

SHA1
6fbea359b24b5b11849b216b7d1481f30690cce4

SHA256
7903613fa2d7b01bbe101ce37d1587908619e9498c86c9d7eebcc9acd2c293ac

SHA512
e0349130628906065cdcc27eacec611e61f750766b624fcc55dbad7f6cd82ca2da7dbfe58ea0d8a8d8b057e66349f2117c0452828ccf9b3c9c8cf317b96d3881

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
1016666830a606085054d2a3aef81879

SHA1
c7f770504a7fe21a2212f6c6eb72ad2da4bc2776

SHA256
9083c73a9e57437c9b44a01b2c5530735ff4baccaf934afa399b9dfd043635b2

SHA512
bcce19a09e54a90aeefb19b4b8ddf9668b4da53a357b529043aa21e102d8c9cc2013db21028b987daa30ada6a7740e3866d49d4805ad4424fd9a48d7e24b4000

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7533db6bed8a013360415c26b1d50b24

SHA1
d5d02cc42c428bf645c436c2ce27f67adfa549f3

SHA256
40ef6d8e90b4648b985088dbe9dc6c39779003518f71f3ea7117768779e07c86

SHA512
e5798db5ebcab646df75bce481643fa75e2f046f9a12f042c1a47543317633015143eb219c62cc4e321c9dce205a8fcc7db7e78939eb4165a311181f51c856ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
7af3e7e29f51a7da1f4250136ae4266e

SHA1
bc497db175acd220cd63824756e54c32e388117a

SHA256
bf05a0e9e3bcd27fb2e4eb2ea66abbfe35c0c29239b5c5976d40279062570c14

SHA512
388c321fb5fae9ff84491436793f203e36bbef77ca5294e97a058ab6171f7fd2415ae2e0cede10029dfa3a8524b357aff0117d28a19ef7cb642cb1faa38ddbfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c56bf0e518ec65830bffadbcce41e6c9

SHA1
141554d7000994bdbc1575a2ba4109fb1d1a9e83

SHA256
6064125f7c6e14ff47c09c23d89b01d3bf9ed4c50df3307324ec1bfc50021f84

SHA512
7e5a29036ab6c5361c7e88460757b9124e3ca655e32bee145b7eaefd6fb8dec503cc8da5110b39369e8010a6f58fe127c07e2a802b0b6c0d2ed815907c25d28c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
e81566ba7e9c7563d4a1339e001207e0

SHA1
785cbc780b0ca6fcf11f1837c2aa9e39895b1729

SHA256
d3cd71700c37e61f2e40dc273cbe59888eb08e4b6bd341bd1efb3126c36d0a0e

SHA512
7e487f42ef923a101002c28eb04c91cd4aca9309c146a44a4e7496772514261fe34a4e1ffc826a3a80a55496a1eb9309b1cacce818f0fdc707f9f836865354f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b2569c55f784c7cee410dab100de1920

SHA1
6fe7794d7d399cb96014522a68a909da508dc68e

SHA256
e04a31566e39cd7843849e0442b6babf2ef16d492f68b87c34ab6282e2adc57a

SHA512
71c21bdfdbc7afa34f5f4d61d31352df945133ebf3497ea24720d70755d7896e85f835991d74448a91d7f72c04619e8be3cc16e891452aef0ef87c64403355f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b3026653486ae65fb0c1439a113ee377

SHA1
d20c007e37816924d6e4e73e2d76a7cc5f2e19e0

SHA256
d2563bd270c1dba444c9ba079fbd2d97591dff14dcd844fbb692425ee896b5ff

SHA512
6be88b2484911aebb56aca85aaaea8e102ad08056cfc81d2038bb76f44406d570469d3bcf31268daa40cc69f8fb473829401d94b72a51e00f54059f60e33b334

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
695d0b2ec6ac50c24724aaa8751ae47c

SHA1
dba1e845e17b3dd59006c1ef47ff30f424851fe0

SHA256
64528331e14e6e4108189859c6b9461770cae05c8d0f390c1344afa3a0201c4b

SHA512
2e7cb95c44113dac623fc7b12a94ca7ca75f279b6fc193664e6c547591955038e359019e4106e3815df9497024aa3acdafd55935a21d1bbbe5758a43fdb90ba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
b086af50afb6d798fc5c588e8c20cad7

SHA1
74579ca3569dfe9d15b020645dbe4ea863c9d98a

SHA256
1354244c7072c77a01635e9a4c0bd9994134f83baf7688f92145159cabbae195

SHA512
03dd18e9aa35a830c55eb067ad926e80da5e5a828fd8d34c51246807b6821c0ffd732f3d81d15402a8eeb2b0b07842777934954472750159bcaa9cfc86551dec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
3dd7aa8bf17abe1423a4c33f1d4ac3e2

SHA1
28992872c0c6cd91e946e375691131d02d14855d

SHA256
f7e38bcfedb8ccc845bab36d04b3cc13be4328588570a81a2920b2986594adcb

SHA512
e885b976f0392ce16a89402ef1266b425964cce7effe077cf97bbddd996a161cb027c8687221f6dd7441dfe5e9f16998a85a1b32586b503b7d51fdc78a9d6427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93be3a1bf9c257eaf83babf49b0b5e01

SHA1
d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

SHA256
8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

SHA512
885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6738f4e2490ee5070d850bf03bf3efa5

SHA1
fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

SHA256
ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

SHA512
2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
202KB

MD5
9901c48297a339c554e405b4fefe7407

SHA1
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e

SHA256
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

SHA512
b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
926dc370ed7ab855677dfd91c5561834

SHA1
07b3379ed7fcf1628219e6cd3833964eafdb43e8

SHA256
ec07c6985d52c1e55b3fb71ec50b90f1f70cba3df8e8c716288bd4c3fb00f4c9

SHA512
b851ba5fe37c5c3cd383f40ad682e7abf84dda416760ab77e61a733d6c712b4bda867beef3530537736e14c4c50e85c84e964571e9b676f6056665239e68b964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
706B

MD5
daedd325cdcd0333e16f3e2856a35f58

SHA1
54d02d27892710b08d9f6050b3fc622483d80cb6

SHA256
2303fc502447c0a2a0ccdf17a9d4df9bd67accfa5a26700bffc8e93cb989109c

SHA512
84df321cb84d875c2b09d32cfaf536386cddde21ed0461d15548a68faef51ae1a9630f8c0c3e360e633e678f67808f18fa15d1f07d9ecab5d4a1ba6a5a417bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a59d27cc22c27f633a0fcb9f69e87a6c

SHA1
5ae46aaadb9c952f2a54afaf8d611baf33f45aef

SHA256
e370a7df0fdf62f22e8f84720f55a5fcb01c3ba1c898bf2d232a285fbcadbb3e

SHA512
c2ccc006519c5f207119b3a96a6e73d3c34d1c46c6a4128afba1f159c9244c9dd204fbee84d2ff91200cc005190cd57a264d4d87e2ecd773bc88e364bcd936fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0430790489aa686bc0a9ad9f6635dbef

SHA1
493e8dcba06213a9421c638aae97cf8e32a40b43

SHA256
39627f0cb85f8d27ec63be4babdacc637216b21deb6a0af00e7c440c6a2d1204

SHA512
11e67e475c8a87a86bafec131c6bd7b43079e5ac6ce36fab0109cbba461e945156b319d434b7f1b51246cc258483511d84a2c5999c099baf157b1d705e7edc2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e549f9f68ac45f043c3c5fe5599441b

SHA1
5c822aa5c4a4ffa8ef53d7ebf2da70a8a83a427b

SHA256
4d166902afb8fc47a7c4b248b1ac0353bb3e65cd3b40fdf40b1c292cffcab52f

SHA512
adb3cb57c8db96747a2dad00beb74bcbef10740370047d4e757159d279ff425ae40adb1aa0ee49c463744c4c99235627b3b214a466cd5fe40f30bdfbaa419fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
acc6d427d5e1f253b5d3062e63d54a33

SHA1
cae1431bfa3364d6c44b4fe4755ee733287e7375

SHA256
4f09026d2ed05055ba7063e36bccdc1987f5b77b069d6d65e212f95cc6581531

SHA512
410366d3c3b96de03ace19b8500eaa7b5485c4e9f226d5ad18c20a5baf5b9c1e0715eebc9b024806078c39cc21e588ff130cd9e7d7ddc6e2e954276ed94866de

Download Submit
C:\Users\Admin\AppData\Local\Temp\autCE0E.tmp

Filesize
359KB

MD5
434da06978e9724ffa6d90b93ef62c75

SHA1
d469ed20d82e8dec3140aec8d52b4d56d975dedc

SHA256
6350e9044f2ac74d8d51793a8b446b944081e533bf2915faf9bc14aaa0c55795

SHA512
391404b4678f296d74d2bc81ae89bb4c423199adc509e69cd573717313ac3078e0f09a90e1dd4e618001608ae5b5aa0f10ae7855d98866179dc05cebfc50053c

Download Submit
C:\Users\Admin\AppData\Roaming\Z1004308289\Baldr (11).exe

Filesize
321KB

MD5
d24276ac40d35830f2b62afae1eb92a4

SHA1
eef691098d9635be8aa8739a3830aae5be889ef7

SHA256
3675e60b99fbbf818883e12da047223ef7490f08fd52df40867785e4586186e7

SHA512
ede7e171d73d64c20681362420f1662a8871bc6dffec806ced6800e3147f2f2d452be68ef738eebe71fce34d24f6549174cb930c1c7368266d416fd40d8db5aa

Download Submit
C:\Users\Admin\AppData\Roaming\Z1004308289\Build.exe

Filesize
1.8MB

MD5
e30988e3026df37370cac7ce85faec85

SHA1
7e2f2cecb759372b6e381afbcda9dffc3e475ad9

SHA256
37bc62e63d2cccc8c326ba42dfbc24d0ed2a2ec967eb4b24c1dce9dedbda5d08

SHA512
ae21cee091a3bb2109552508a2f03c46c9c6ea63a2b33c794fce9b6ee3ceae185e9a06ccf6d11894696b231935c5c3c5dfea9aec370b1b4282a5bce58fde1c7b

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\1\Information.txt

Filesize
4KB

MD5
e0a8972d1f9eb60e2f4c57ff1fdc6535

SHA1
628c5864cf8b7dc3ccd7d61a3adec23cdbb3fdbb

SHA256
b63e8c0cfbc757ea7bac6d289915abcc312594467b1be738ad8e19fd0239f708

SHA512
52c9906c313dbfe286d9f380e1d3f446a9330fdf70cc237835d0372cc9f70842da4848fc5b6ad0fdbed4ea6a2d79ce43e06ea35b490d3dbef8466ea379fc56b2

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\1\Screen.jpg

Filesize
53KB

MD5
4a08ff26099f2f771579a2ba9d20f7c8

SHA1
e1ebc25fb189dc0541e72e3048b9e2ff8f457ff5

SHA256
ddc3139fe73695cfdd0d38ffa8f0cfefec4eca55920846a80b5ef9a5a42318aa

SHA512
800349d89b9c45a3984c9d7c7cec6c6c333d93bfb032e5211b02d1d7d8b414c63e4b95d6243465925c9b368fe5935c9729ef1b041465fe135e6f3a846a711802

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.module.exe

Filesize
218KB

MD5
9c5b4e4fcae7eb410f09c9e46ffb4a6d

SHA1
9d233bbe69676b1064f1deafba8e70a9acc00773

SHA256
0376139308f3e83a73b76d3938d9c100779a83b98eeb3b3ebacfcbd1cc027fe9

SHA512
59c35d730dc17e790aa4c89f82fd2f64b4d67405c2bdf21d4a9757fa8bfb64461f1247c9da482b310b117f1a24144bf6c612c9f7587577b7a286e2e3de724ee5

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.module.exe.6

Filesize
218KB

MD5
e82f9401a1e258f204020186f9a714ec

SHA1
9493e1ecaf8d24dc41df6811b96b459fe046dbdc

SHA256
76eb583552ef509e5c1c2cac4abc8442c0bbd59ce5c78a46c0f3da18158d542e

SHA512
f3514debb1e1f1a5dea4565e236105adbdbe05cbe509e8335ad4f1558b4beffbfbf0c519bcb4530760f5a3c39743ff1935818949c140bb694803a8ad15beddaf

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-winre-recoveryagent\Wpc.sqlite3.module.dll

Filesize
359KB

MD5
a6e1b13b0b624094e6fb3a7bedb70930

SHA1
84b58920afd8e88181c4286fa2438af81f097781

SHA256
3b266088e1eb148534a8f95610e07749f7254f29d19f6f6686a1f0c85c9241bd

SHA512
26c2dffb44b7b0c2eb6e8fde7d5c6dce118af14971552bedeb131436f53edd28da98af8cf219bb7814cf4563624638cf73c7017fc3936b5112ff9f8c43f11591

Download Submit
memory/1200-37-0x0000000073340000-0x0000000073AF0000-memory.dmp

Filesize
7.7MB

Download
memory/1200-32-0x0000000008FD0000-0x0000000009046000-memory.dmp

Filesize
472KB

Download
memory/1200-13-0x000000007334E000-0x000000007334F000-memory.dmp

Filesize
4KB

Download
memory/1200-25-0x0000000000C00000-0x0000000000C46000-memory.dmp

Filesize
280KB

Download
memory/1200-30-0x0000000000C50000-0x0000000000C56000-memory.dmp

Filesize
24KB

Download
memory/1200-99-0x0000000073340000-0x0000000073AF0000-memory.dmp

Filesize
7.7MB

Download
memory/1200-94-0x0000000004E90000-0x0000000004EAE000-memory.dmp

Filesize
120KB

Download
memory/1200-31-0x0000000073340000-0x0000000073AF0000-memory.dmp

Filesize
7.7MB

Download
memory/1200-29-0x0000000073340000-0x0000000073AF0000-memory.dmp

Filesize
7.7MB

Download
memory/1200-33-0x0000000073340000-0x0000000073AF0000-memory.dmp

Filesize
7.7MB

Download
memory/1200-36-0x0000000005340000-0x00000000058E4000-memory.dmp

Filesize
5.6MB

Download
memory/1200-35-0x0000000002590000-0x00000000025F6000-memory.dmp

Filesize
408KB

Download
memory/1200-34-0x0000000004CF0000-0x0000000004D82000-memory.dmp

Filesize
584KB

Download
memory/2224-73-0x0000000000690000-0x0000000000867000-memory.dmp

Filesize
1.8MB

Download
memory/2660-131-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2660-87-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2660-91-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2660-130-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/3760-124-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3760-129-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download