a670a250064785b2e431ae33d8269b56da71cd5f94fea53c798cf1924d25a2ce

Analysis

max time kernel
301s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InazumaElevenVRSaveEditor.exe
Size 94.1MB
Sample260706-vtkwcah12v
SHA256 a670a250064785b2e431ae33d8269b56da71cd5f94fea53c798cf1924d25a2ce
MD5 f64bb85dd221da2a439923a16bb15d69
SHA1 d84337270a0fc9419a6202ffc84273e3284e3f27
SHA512 d9409ddc723ef3e267a43f45deee724553ab721fdbd3ece5b7d85aacd9be07c2ab6537be48717a87fa8963c72bc690226f38d7e2cae3eea7038c3d4495d9f479
SSDEEP 1572864:lg/jD99lRkR2Pz8ex+9KFaJUPBIbUTK4vXkzot5630rIc4de9rszPT/jzdMso+:l2pTRkR8zP49KFOUpIbUTtP6kk9de1sZ
TLSH
T14D282356E2F923D8D47AC9BC85764517EFB23C05132096DB11A4BA192F33AE35E39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
1944	InazumaElevenVRSaveEditor.exe
1944	InazumaElevenVRSaveEditor.exe
1944	InazumaElevenVRSaveEditor.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\O:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\R:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\Z:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\N:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\P:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\G:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\K:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\M:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\V:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\J:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\T:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\U:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\W:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\Y:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\Q:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\A:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\B:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\D:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\H:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\I:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\S:	InazumaElevenVRSaveEditor.exe
File opened (read-only)	\??\X:	InazumaElevenVRSaveEditor.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{B29A7879-048B-4F4B-86E0-9B84AC7EA88B}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{44E2FE5A-0AC7-4F95-95B0-634CA51A9F36}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1944	InazumaElevenVRSaveEditor.exe
3176	explorer.exe
3176	explorer.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	InazumaElevenVRSaveEditor.exe
Token: SeShutdownPrivilege	1944	InazumaElevenVRSaveEditor.exe
Token: SeCreatePagefilePrivilege	1944	InazumaElevenVRSaveEditor.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe
Token: SeShutdownPrivilege	3176	explorer.exe
Token: SeCreatePagefilePrivilege	3176	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3820	sihost.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe
3176	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3360	StartMenuExperienceHost.exe
3968	SearchHost.exe
3176	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 3176	3820	sihost.exe	92

C:\Users\Admin\AppData\Local\Temp\InazumaElevenVRSaveEditor.exe
"C:\Users\Admin\AppData\Local\Temp\InazumaElevenVRSaveEditor.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3176

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\InazumaElevenVRSaveEditor\08kjVSKw7EsFVQQARg_spxpvz9IaOKc=\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\InazumaElevenVRSaveEditor\08kjVSKw7EsFVQQARg_spxpvz9IaOKc=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 8b8ebd4c23e33dbc19d0c809c01d8ab3ce9e66f191e29ffc2d3417a63bd90926
MD5 a79a2831bfd6e600f63761ac5ba60155
SHA1 009f43b40f51183be48b4de277c37e2d8cec7d21
SHA512 f0cbde7a1b218a5ef4b9dca170b7f41925c2da9dac71b279b99ccfdb07e1f9c8db5b643ea1b914b1381ae9813015c5dcc66027ad522a9c401ed7d53544f8bb23
SSDEEP 24576:/jOnXauaPQDzcpsVOE4PU5tbg5ChWmAjHSa+YrHAvlFk8TQh6p1zwPwYffvhX0jn:RuaofcpsQ5PU5ZhWmAjHjAvlF5QhURwi
TLSH
T16D453A62D2E642E4C47FC1B8C646972BFBB1740A131C66DB47608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\InazumaElevenVRSaveEditor\08kjVSKw7EsFVQQARg_spxpvz9IaOKc=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 92c7d4559adabfecd9b944cc47d3671fef0ed7c68afb2d589c2b4e80a1786087
MD5 91f3362d0694e277e04a36af22bdd6c5
SHA1 d5544433ef87013a7e9f8110d2abbf7f420f859b
SHA512 dcb370493b54ea479a60022e746b1b94d6ed86dfb4d56038cc7c1e73c5afa8ac2300c3f8a4a0989bd2d277969cc86e7277fb4051311f9ab7090074f46d78011b
SSDEEP 24576:bek+C9iX4izlWkFLgcUxSdHaKzhWjl9sIovgbAvJh5A2RwK2Ebie2a9dRghF0hD:gPoKlWkF3CSpaPl1oYbA35A252Eb1yOD
TLSH
T16895494AB6EC40E9C47AD23CDADB461BF63174152761A7CF23A0479D6F27BD00A7A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-7-0x00000235007C0000-0x0000023500CD0000-memory.dmp

Download

memory/1944-29-0x00000235040B0000-0x0000023504140000-memory.dmp

Download

memory/1944-24-0x0000023500130000-0x0000023500140000-memory.dmp

Download

memory/1944-68-0x0000023504E40000-0x0000023504E50000-memory.dmp

Download

memory/1944-88-0x0000023507560000-0x0000023507570000-memory.dmp

Download

memory/1944-84-0x0000023507550000-0x0000023507560000-memory.dmp

Download

memory/1944-12-0x0000023508390000-0x000002350D620000-memory.dmp

Download

memory/1944-80-0x0000023507530000-0x0000023507540000-memory.dmp

Download

memory/1944-76-0x00000235074F0000-0x0000023507510000-memory.dmp

Download

memory/1944-99-0x00000235075A0000-0x00000235075D0000-memory.dmp

Download

memory/1944-111-0x00000235075D0000-0x00000235075E0000-memory.dmp

Download

memory/1944-131-0x00000235082C0000-0x0000023508310000-memory.dmp

Download

memory/1944-143-0x0000023508330000-0x0000023508340000-memory.dmp

Download

memory/1944-139-0x0000023508250000-0x0000023508270000-memory.dmp

Download

memory/1944-135-0x00000235077F0000-0x0000023507800000-memory.dmp

Download

memory/1944-127-0x0000023508220000-0x0000023508240000-memory.dmp

Download

memory/1944-123-0x00000235077D0000-0x00000235077E0000-memory.dmp

Download

memory/1944-119-0x0000023507750000-0x0000023507760000-memory.dmp

Download

memory/1944-115-0x00000235077A0000-0x00000235077D0000-memory.dmp

Download

memory/1944-103-0x0000023507B00000-0x0000023507E00000-memory.dmp

Download

memory/1944-107-0x0000023507710000-0x0000023507730000-memory.dmp

Download

memory/1944-95-0x0000023507650000-0x00000235076C0000-memory.dmp

Download

memory/1944-72-0x00000235074D0000-0x00000235074E0000-memory.dmp

Download

memory/1944-64-0x0000023504E20000-0x0000023504E30000-memory.dmp

Download

memory/1944-60-0x0000023504E00000-0x0000023504E10000-memory.dmp

Download

memory/1944-56-0x0000023504D60000-0x0000023504D70000-memory.dmp

Download

memory/1944-52-0x0000023504D40000-0x0000023504D50000-memory.dmp

Download

memory/1944-48-0x0000023504DB0000-0x0000023504DF0000-memory.dmp

Download

memory/1944-45-0x0000023500190000-0x00000235001A0000-memory.dmp

Download

memory/1944-40-0x00000235051C0000-0x0000023505520000-memory.dmp

Download

memory/1944-36-0x0000023504D10000-0x0000023504D30000-memory.dmp

Download

memory/1944-32-0x0000023500150000-0x0000023500180000-memory.dmp

Download

memory/1944-20-0x0000023503F10000-0x0000023504020000-memory.dmp

Download

memory/1944-17-0x0000023504700000-0x0000023504CC0000-memory.dmp

Download

memory/1944-163-0x000002350D620000-0x000002350D630000-memory.dmp

Download

memory/1944-159-0x000002350D790000-0x000002350D7B0000-memory.dmp

Download

memory/1944-155-0x000002350D760000-0x000002350D790000-memory.dmp

Download

memory/1944-147-0x000002350E290000-0x000002350EC10000-memory.dmp

Download

memory/1944-151-0x000002350D690000-0x000002350D6F0000-memory.dmp

Download

memory/1944-167-0x000002350D870000-0x000002350D8B0000-memory.dmp

Download

memory/1944-171-0x0000023500110000-0x0000023500120000-memory.dmp

Download

memory/1944-175-0x000002350D8B0000-0x000002350D910000-memory.dmp

Download

memory/1944-179-0x000002350F670000-0x000002350F690000-memory.dmp

Download

memory/1944-185-0x000002350F900000-0x000002350F9A0000-memory.dmp

Download

memory/1944-183-0x000002350F7B0000-0x000002350F860000-memory.dmp

Download

memory/1944-195-0x000002350FD70000-0x000002350FDB0000-memory.dmp

Download

memory/1944-191-0x000002350FCE0000-0x000002350FD00000-memory.dmp

Download

memory/1944-204-0x00000235105D0000-0x00000235105E0000-memory.dmp

Download

memory/1944-208-0x00000235106E0000-0x00000235107A0000-memory.dmp

Download

memory/1944-212-0x000002350D700000-0x000002350D710000-memory.dmp

Download

memory/1944-216-0x0000023510CB0000-0x0000023510D60000-memory.dmp

Download

memory/1944-220-0x0000023510BC0000-0x0000023510BD0000-memory.dmp

Download

memory/1944-228-0x0000023510EC0000-0x0000023510F10000-memory.dmp

Download

memory/1944-224-0x0000023510D90000-0x0000023510DC0000-memory.dmp

Download

memory/1944-240-0x0000023511040000-0x0000023511110000-memory.dmp

Download

memory/1944-247-0x0000023511440000-0x00000235114C0000-memory.dmp

Download

memory/1944-243-0x0000023510BE0000-0x0000023510BF0000-memory.dmp

Download

memory/1944-251-0x0000023510F10000-0x0000023510F50000-memory.dmp

Download

memory/1944-255-0x00000235109A0000-0x0000023510BA9000-memory.dmp

Download

memory/3968-275-0x0000015A001E0000-0x0000015A002E0000-memory.dmp

Download

memory/3968-322-0x0000015A14210000-0x0000015A14230000-memory.dmp

Download

memory/3968-308-0x0000015A03B90000-0x0000015A03BB0000-memory.dmp

Download

memory/3968-293-0x0000015A13D90000-0x0000015A13E90000-memory.dmp

Download

memory/3968-291-0x0000015A03930000-0x0000015A03950000-memory.dmp

Download