hxxp://fixtool[.]cc/testtest

Resubmissions

28/03/2025, 09:53

250328-lwmy2swny9 9

Analysis

max time kernel
110s
max time network
110s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fixtool.cc/testtest

Score

9^/10

defense_evasion discovery spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
108	2928	powershell.exe
114	2928	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
114	2928	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000\Control Panel\International\Geo\Nation	updater.exe

Executes dropped EXE 2 IoCs

pid	Process
4968	updater.exe
2996	Chrome_boostrap.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000200000002707a-645.dat	themida
behavioral1/memory/4968-680-0x0000000000B20000-0x0000000001410000-memory.dmp	themida
behavioral1/memory/4968-681-0x0000000000B20000-0x0000000001410000-memory.dmp	themida
behavioral1/memory/4968-709-0x0000000000B20000-0x0000000001410000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
116	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4968	updater.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe	updater.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	updater.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876291968449275"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3174447216-2582055397-1659630574-1000\{A9322FE7-6A46-4EB9-8176-E74E60418F30}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2928	powershell.exe
2928	powershell.exe
2928	powershell.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe
4968	updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeIncreaseQuotaPrivilege	2928	powershell.exe
Token: SeSecurityPrivilege	2928	powershell.exe
Token: SeTakeOwnershipPrivilege	2928	powershell.exe
Token: SeLoadDriverPrivilege	2928	powershell.exe
Token: SeSystemProfilePrivilege	2928	powershell.exe
Token: SeSystemtimePrivilege	2928	powershell.exe
Token: SeProfSingleProcessPrivilege	2928	powershell.exe
Token: SeIncBasePriorityPrivilege	2928	powershell.exe
Token: SeCreatePagefilePrivilege	2928	powershell.exe
Token: SeBackupPrivilege	2928	powershell.exe
Token: SeRestorePrivilege	2928	powershell.exe
Token: SeShutdownPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeSystemEnvironmentPrivilege	2928	powershell.exe
Token: SeRemoteShutdownPrivilege	2928	powershell.exe
Token: SeUndockPrivilege	2928	powershell.exe
Token: SeManageVolumePrivilege	2928	powershell.exe
Token: 33	2928	powershell.exe
Token: 34	2928	powershell.exe
Token: 35	2928	powershell.exe
Token: 36	2928	powershell.exe
Token: SeDebugPrivilege	4968	updater.exe
Token: SeDebugPrivilege	4968	updater.exe
Token: SeDebugPrivilege	4968	updater.exe
Token: SeIncreaseQuotaPrivilege	2928	powershell.exe
Token: SeSecurityPrivilege	2928	powershell.exe
Token: SeTakeOwnershipPrivilege	2928	powershell.exe
Token: SeLoadDriverPrivilege	2928	powershell.exe
Token: SeSystemProfilePrivilege	2928	powershell.exe
Token: SeSystemtimePrivilege	2928	powershell.exe
Token: SeProfSingleProcessPrivilege	2928	powershell.exe
Token: SeIncBasePriorityPrivilege	2928	powershell.exe
Token: SeCreatePagefilePrivilege	2928	powershell.exe
Token: SeBackupPrivilege	2928	powershell.exe
Token: SeRestorePrivilege	2928	powershell.exe
Token: SeShutdownPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeSystemEnvironmentPrivilege	2928	powershell.exe
Token: SeRemoteShutdownPrivilege	2928	powershell.exe
Token: SeUndockPrivilege	2928	powershell.exe
Token: SeManageVolumePrivilege	2928	powershell.exe
Token: 33	2928	powershell.exe
Token: 34	2928	powershell.exe
Token: 35	2928	powershell.exe
Token: 36	2928	powershell.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3268	3032	msedge.exe	80
PID 3032 wrote to memory of 3268	3032	msedge.exe	80
PID 3032 wrote to memory of 3864	3032	msedge.exe	81
PID 3032 wrote to memory of 3864	3032	msedge.exe	81
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 1704	3032	msedge.exe	82
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83
PID 3032 wrote to memory of 2628	3032	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://fixtool.cc/testtest
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ffb1b06f208,0x7ffb1b06f214,0x7ffb1b06f220
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2260,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2224,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3476,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4220,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4280,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3612,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3552,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5116,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4448,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6112,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4500,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6272,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6568,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6736,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6732,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6780,i,5836920195336187642,4570501988401029993,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Downloads MZ/PE file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
- C:\Users\Admin\AppData\Local\35448c1e-232a-4288-8aef-2f0b56f8753b\updater.exe
  "C:\Users\Admin\AppData\Local\35448c1e-232a-4288-8aef-2f0b56f8753b\updater.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- - C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe
    "C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"
    3⤵
    - Executes dropped EXE
    PID:2996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\35448c1e-232a-4288-8aef-2f0b56f8753b\updater.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      System Location Discovery: System Language Discovery
      PID:2184

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe

Filesize
37KB

MD5
af69d667761ef87674be3d231a0ae0e6

SHA1
a938c72cfd162d097391d3f53f0097fda5a9543f

SHA256
55b2905b08f0715379db90291712363f16a80b3bfb33513012cb9ac7cbff4343

SHA512
32a1994162bb873da35f99816b8740b61e8f9b5a3e22e4aa19704848b4760208f23989f174822669a3105719647c3db9145ae0a227cf41d967d50935da66c4ab

Download Submit
C:\Users\Admin\AppData\Local\35448c1e-232a-4288-8aef-2f0b56f8753b\updater.exe

Filesize
3.4MB

MD5
3c13352c48977fba21dffcb1ae53c6d7

SHA1
e92a0c8912b253ac8133d5e54fa7b7da17958fb6

SHA256
8189e8995613f940bdaae2b6c1af8977874d6e0ea625d9547c9b8e1b5d59bd87

SHA512
97993e2b8b6ee390f6c5fa6064c62e824d5f7001e109ef930a175050fa2ef21b5db1773127b8a54b6357f7f9f214f7f562de22cf8614a922549d93bdbd0b8b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a46a324553367dc0b13a007305e4f102

SHA1
005a700ac0bf4429024f9e857e2281f82f370aed

SHA256
a718f2fe90be4422382450b4959840a13d6d18dea09d3da5394624198a126063

SHA512
d3b9fcde15be13451aa441070d9143fc53faa6a2725adea7fb9c340bcb9d7ea183dc1b36c0f8ec21c1748c80bc8fa03a14f198c2fc914c9f8e81702bd8e18399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
addd0f9357cd846e387c56c7886a6e24

SHA1
1504051613ceae8aa8f766277726240285700f5e

SHA256
021690f38b3ce660357e40a18b15f8e96c72f7f659ae753bb28dc38411809be2

SHA512
850c3357379ecf88db1ab563597030c498b4b076d0da134fb8200b6d8cb068aac473d77a55a7063d591fb3df0c3a716f3826dc338c2563cc819c5f285407affe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
29f13140c50c2394177caf96baf3a5c0

SHA1
680e35060382a846752eb208b62de077d31fd1eb

SHA256
f4554eb3e1e133edb5f5f01e19539ffc52adc0b346e19c4742a815e7a92b2dcb

SHA512
d964d066a2913d3b6eb73925160d7e9d79a94ae5c6e3956cd361b54fe53833b311990a91346917bc90b227301d864939f6a5a417ff52ef9fe8e21971b1a661fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5f6fe5e124f8a9e7cb02322918895e44

SHA1
d0b3e6d8fe754a96ca2f40e794cffbe640d4df17

SHA256
af07ea90e514d89a69da78d10974c65a10241ed94f103b584b1589bb58247c4f

SHA512
57e9aca7c6047528a9742319572d95f12f87e0ce2e6f2f9ca5535711268573a58ac7b6b18ead34b2167977bce91989c63f60c91028f038778628b47990e0f494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57a400.TMP

Filesize
3KB

MD5
cdd593f42818452995862fe14b4da82f

SHA1
eb8e86e914e8c0ec7c2a589e2d4b73dcfcc4d229

SHA256
0edbe19497baf2a416748045b137d53076dc24f7e454b6cca6babae596268187

SHA512
79a765af6a3831c73f46574451e80a3bd3027154b5c9c9ddc3703933fb998b1ed8674a9c710d72617e8775f2d48416408a9672fb20808a338fbc0e0d4679661d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2c1432d66cf88e12164018a443990d9a

SHA1
4751202ea7ef0b88f9db4aff4a81e8670276db0e

SHA256
3f741ce38c9f7d0a32d85065a3d53d441d4a2a05b9b1ee144a3ac917cde7669a

SHA512
1834a4588d8245686f09ca76a955703fd38ddc23458110ae0889f234fadf2308fce60a59e5999a01d73a2723b9b733a502cce3d1ea1cc499b9c2204a644eaa01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b377a4d73247ccb0ec9c9d6a862a511f

SHA1
4888f24c973fde65fcdcb7905da431601d3fd8f1

SHA256
48e8480b90e65a7093fac238da1289569871f2a80a6d0ce21c2ad99e512bca64

SHA512
c55ef2062d281ae31d9a21ee22b999c2fa168938a4394c6ccde6d9317ae351b2e69e991a4454c76da96c8cefd4e47d91e69a9c069d381803702327ef7fe590c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
f4ffae5f9da7566628d6be84ad5d800c

SHA1
866556287ef3dbf4509270af8de722fc4ad1d73a

SHA256
2180dd2e6784b8b5ecee2b59ae444be68b50ae6e209a930c2c87fbc92a555e08

SHA512
cd799609ab79e31d106b0762713b34a7f6ea126ccec451f4d183fafcbbcb10f759d74e9c0d8274f0e6e2e33893d349ec0945c8e35cf082bd3e517fdea64db6ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
41dc432f0cd71b117314d6c8da61fcf5

SHA1
9299a21e6d808dff038538c834ff0c0fccdf8d5b

SHA256
81ffcca65d9d68021e6cc61e9584f3203183a365d5b4a3586efdd1f8930f5740

SHA512
966cc5c4c62b9e64ad65131418b4870941871545da95a97d272f83454c77206caa873ca603e5e42aafb2f021ba58fce19fa5e53a1d3fef654af9bed1ec0ea9bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
78c06bbec5a016ab85b523128de2e511

SHA1
43f9984d316d36054b75d3fc975d92b4ef19c5d4

SHA256
fb11a5b0f24b9a20bfa2383fa81428a99ce92475452d73e2eef078ef9f8496ad

SHA512
ae25d9b83b98818625fc847be23787835998e36c9c9c623c0cb418b497ee65b6dd8d77b9c70b3a091ac03dd8d77c889e5a3b3c434d8f56f2fd95b5ac231f2af5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
fbd75fb0f0e91710b4009266ce58ade8

SHA1
ab403bddd2c6b3904cb38695e5bf1df070421d88

SHA256
17a30ce6de0aa674b77eecd3b7c5efe7329e92a82b15a1d62ec7adf55a0f5635

SHA512
f1a7d22e9b20180430238dde8a864e6db6553643bdd8413dbbc5fd1ee9dc9b6489abe1d05a15f6042b639e7589e83e4b7977db378643c8fd621ae71c5e7d2357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
0833bb63535ccb7c44a61ff37c439a62

SHA1
263995e1f6600c5d14ac59b6ec2eea2239e842b7

SHA256
f767aa118ce7896dfb27fa6691859304c54a235d73647297f9b6e11312656457

SHA512
cf1b266ea8ee52c0649def95f9b088b05f0288c170459e50ffaba2633323f06d5648e5985c972b2cee517930ac7377d93961a72da934cff4105a20fbe25d1f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
7afc86db107858e71c0f82253999fca1

SHA1
d1da9bd17be21832dc30379678a06280822cad47

SHA256
68b319860deb82a885b285f6bb7a3433e7bde3c4c5387bd3d8efe8c27b678aad

SHA512
3b3f7f420f6bc2e023971c067ebbf26aa005029f4e2c46a7cc1631f70a7751b6ced3bd0e6663b9b8f420e8498f5ad036fcfda7aa252591b9002ae1b9d7fec8d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
466ec3730cd332e7543d34cae429be5e

SHA1
743a1108a189d79e6543133e9f32668d7dd72ecc

SHA256
28fc247fb59c5c52f424eb4fcff47651b84723ad82c58c045b29f3ffddc08962

SHA512
0b96d2c66acb646f09aea5808a7416d86f0cd199dea5a7db85e8239c0430d2389651e428f8834d48c20b73066b88908f5eafa855e9349ee347054a6dd96f4e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\4092854b-fcb8-4f21-8f9e-12506ca3e5b4.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pwv1bbml.ww5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\Log_SystemCLS.txt

Filesize
44B

MD5
a6f1ad4ae54476c2cf3e2508b57fcf5f

SHA1
3e7507346db1b7a9fa006cd77ebf22681efa9693

SHA256
674ba53f4f6f5f488e547e6a86564f4278885db31def83cc90fa9c156c6dff85

SHA512
efd4d3d6b75aba5a4081165c0c3f1186a7f44bf934dbe97c3e492580594df3a247ee2882a29a5fcb0faa9ab890c9eba78fcdb7045fd768d9463e8e4253bec877

Download Submit
memory/2928-633-0x0000023FAE170000-0x0000023FAE192000-memory.dmp

Filesize
136KB

Download
memory/2928-635-0x0000023FAE760000-0x0000023FAE7D6000-memory.dmp

Filesize
472KB

Download
memory/2928-639-0x0000023FAEF90000-0x0000023FAF736000-memory.dmp

Filesize
7.6MB

Download
memory/2928-634-0x0000023FAE690000-0x0000023FAE6D4000-memory.dmp

Filesize
272KB

Download
memory/4968-688-0x0000000006F10000-0x0000000006F60000-memory.dmp

Filesize
320KB

Download
memory/4968-685-0x0000000006FE0000-0x00000000071A2000-memory.dmp

Filesize
1.8MB

Download
memory/4968-686-0x0000000006E90000-0x0000000006F06000-memory.dmp

Filesize
472KB

Download
memory/4968-682-0x0000000006570000-0x0000000006B16000-memory.dmp

Filesize
5.6MB

Download
memory/4968-681-0x0000000000B20000-0x0000000001410000-memory.dmp

Filesize
8.9MB

Download
memory/4968-680-0x0000000000B20000-0x0000000001410000-memory.dmp

Filesize
8.9MB

Download
memory/4968-676-0x0000000000B20000-0x0000000001410000-memory.dmp

Filesize
8.9MB

Download
memory/4968-702-0x0000000007C40000-0x000000000816C000-memory.dmp

Filesize
5.2MB

Download
memory/4968-703-0x0000000005E10000-0x0000000005E22000-memory.dmp

Filesize
72KB

Download
memory/4968-704-0x000000000B610000-0x000000000B62E000-memory.dmp

Filesize
120KB

Download
memory/4968-705-0x000000000B6D0000-0x000000000B736000-memory.dmp

Filesize
408KB

Download
memory/4968-706-0x000000000B7E0000-0x000000000B872000-memory.dmp

Filesize
584KB

Download
memory/4968-709-0x0000000000B20000-0x0000000001410000-memory.dmp

Filesize
8.9MB

Download