Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/02/2025, 01:26

250213-btppra1pcz 10

17/01/2025, 20:14

250117-yz7h3s1qfw 10

17/01/2025, 20:12

250117-yy9l2sslcr 10

17/01/2025, 17:25

250117-vy9p9sxpez 10

17/01/2025, 17:21

250117-vw8eesyjfp 10

17/01/2025, 14:16

250117-rk9ass1rhk 10

17/01/2025, 14:12

250117-rhv1ds1lds 10

16/01/2025, 12:52

250116-p4et7a1mez 10

Analysis

  • max time kernel
    898s
  • max time network
    901s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2025, 01:26

General

  • Target

    Malware-1-master/96591.exe

  • Size

    1.2MB

  • MD5

    568d17d6da77a46e35c8094a7c414375

  • SHA1

    500fa749471dad4ae40da6aa33fd6b2a53bcf200

  • SHA256

    0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615

  • SHA512

    7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427

  • SSDEEP

    12288:D+FwW6Se3oB/8WjH2fIGOVoDJLvfOqsUFY:D+qJSgZwEIGOVUJLnOqs+Y

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • System policy modification 1 TTPs 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\96591.exe
    "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\96591.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\96591.exe
      "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\96591.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:3916
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTEzNzVDRkItQkE2Ni00NkJFLUI0OTQtQzE1RDJFQUJDM0RDfSIgdXNlcmlkPSJ7RDMwNzNBQ0ItQ0JCNi00QTNGLUI4NEItMTVFMDdEMTE5MDgyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Q0Q4NkNDNTUtRUZDNS00NDFCLThENjItNjIwRUZFMDY4OTNBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODYxMTgxMzE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2500
  • C:\Windows\SysWOW64\ifacemachine.exe
    "C:\Windows\SysWOW64\ifacemachine.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Windows\SysWOW64\ifacemachine.exe
      "C:\Windows\SysWOW64\ifacemachine.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2952
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1712
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\MicrosoftEdge_X64_133.0.3065.59.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      1⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1560
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7113e6a68,0x7ff7113e6a74,0x7ff7113e6a80
          3⤵
          • Executes dropped EXE
          PID:3508
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3160
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7113e6a68,0x7ff7113e6a74,0x7ff7113e6a80
            4⤵
            • Executes dropped EXE
            PID:1364
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3936
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7eec26a68,0x7ff7eec26a74,0x7ff7eec26a80
            4⤵
            • Executes dropped EXE
            PID:4104
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3828
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7eec26a68,0x7ff7eec26a74,0x7ff7eec26a80
            4⤵
            • Executes dropped EXE
            PID:1956
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7eec26a68,0x7ff7eec26a74,0x7ff7eec26a80
            4⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:4940
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
      1⤵
        PID:1444
      • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
        "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4080
      • C:\Windows\system32\wwahost.exe
        "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2120
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:440
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\EDGEMITMP_EC5C7.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\EDGEMITMP_EC5C7.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --previous-version="132.0.2957.140" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\EDGEMITMP_EC5C7.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\EDGEMITMP_EC5C7.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\EDGEMITMP_EC5C7.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6497d6a68,0x7ff6497d6a74,0x7ff6497d6a80
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:2896
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTEzNzVDRkItQkE2Ni00NkJFLUI0OTQtQzE1RDJFQUJDM0RDfSIgdXNlcmlkPSJ7RDMwNzNBQ0ItQ0JCNi00QTNGLUI4NEItMTVFMDdEMTE5MDgyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins3QUNGMzg5Mi02NTY4LTQwN0QtOTExMy0zMjQxRDFGRDc5NTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjUiIGNvaG9ydD0icnJmQDAuNDIiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7MTI4OTUwM0YtNUM5MS00RjlFLTlFODUtNkFDMDcyQzQwMjc4fSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMy4wLjMwNjUuNTkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iNSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzNDIzMjkxOTQ3NDEzMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk0NjgwNzI0NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTQ2OTYyODYxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTM3MjE1NDY4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZmVkNTU4MDUtMmU4NS00MWQ4LWI0ZTMtNGVmNmI1ZWJmNjNhP1AxPTE3NDAwMTQ4NDQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VFFRQlphbGxRMzJLSjRaSkREY3FQcCUyZjhOazQyZDBadXhicVB4aTl5bkJITTZRVyUyZnglMmYlMmYlMmJUNW4xYkNaTDNqR3A2ODFLTkEyRlQlMmZVdyUyZmhubzg4M3JaQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MzcyMTU0NjgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2ZlZDU1ODA1LTJlODUtNDFkOC1iNGUzLTRlZjZiNWViZjYzYT9QMT0xNzQwMDE0ODQ0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVRRUUJaYWxsUTMyS0o0WkpERGNxUHAlMmY4Tms0MmQwWnV4YnFQeGk5eW5CSE02UVclMmZ4JTJmJTJmJTJiVDVuMWJDWkwzakdwNjgxS05BMkZUJTJmVXclMmZobm84ODNyWkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzg2MDQwODgiIHRvdGFsPSIxNzg2MDQwODgiIGRvd25sb2FkX3RpbWVfbXM9IjUyOTk0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MzczNzE4NDgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU1MDQ5NjY3NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE5NDQwNDMyNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjY5MzciIGRvd25sb2FkX3RpbWVfbXM9IjU5MDQxIiBkb3dubG9hZGVkPSIxNzg2MDQwODgiIHRvdGFsPSIxNzg2MDQwODgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjY0MzkxIi8-PHBpbmcgYWN0aXZlPSIxIiBhPSI2IiByPSI2IiBhZD0iNjYxMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7NjBDNzVBRTgtREZEQS00RjFBLThDRDctNjEwNjI5N0YyNkRDfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IjEzMy4wLjMwNjUuNTkiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZT0iNjYwOCIgY29ob3J0PSJycmZAMC4xNCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk0NjgwNzI0NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTk0NDA0MzI1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzMyNjg0Nzg3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYTQ3MmVjZWMtYWU2OS00NDllLWI3YTItNGU4NmRmZWU1OGE5P1AxPTE3NDAwMTQ4NDQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SHE5JTJiRWE3N2FqM2pQUGNNeVRnMnhBVHBETjI0a29aUW9yVCUyZldBMng0N3d1Tk1tM1JsRjlhMVl4JTJmcE1pdURiNHl4JTJmJTJieGY3c3pEU2JnRnBNVGQxejBRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjMzMjY4NDc4NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYTQ3MmVjZWMtYWU2OS00NDllLWI3YTItNGU4NmRmZWU1OGE5P1AxPTE3NDAwMTQ4NDQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SHE5JTJiRWE3N2FqM2pQUGNNeVRnMnhBVHBETjI0a29aUW9yVCUyZldBMng0N3d1Tk1tM1JsRjlhMVl4JTJmcE1pdURiNHl4JTJmJTJieGY3c3pEU2JnRnBNVGQxejBRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iNTg0OTgxMjgiIHRvdGFsPSI1ODQ5ODEyOCIgZG93bmxvYWRfdGltZV9tcz0iMTMyMzQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjMzMjY4NDc4NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzQwNDk3Mjc4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2ODQ2OTA0MTM1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNjkzNyIgZG93bmxvYWRfdGltZV9tcz0iMTM4MjgiIGRvd25sb2FkZWQ9IjU4NDk4MTI4IiB0b3RhbD0iNTg0OTgxMjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjUwNjQxIi8-PHBpbmcgcj0iNiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7M0QzQjg3NjEtQzUwNi00RDIwLUI0NTktNjYzN0JFMDA2ODIzfSIvPjwvYXBwPjwvcmVxdWVzdD4
        1⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1572
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3784

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\msedge_7z.data

        Filesize

        3KB

        MD5

        a43e9ce8d33ed6eb2b8f5133450d64dd

        SHA1

        f2b9a2eab4b80d7bef0a6e076423993b77f66332

        SHA256

        39bace95aa685a42bb379404c0e4f2a11254a7d5ab9a9b5551d311d1dbc05bb6

        SHA512

        9db1c9de9521cd7bd4af5062693d3557ab196fd552bb6000c1d4266426127c9c7c6eada263e90f99bf941fb1c863d10463940e164a03e0742ee070a35fbcdf6e

      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAD291D3-EE89-4F8A-86E9-22725910821E}\EDGEMITMP_EC5C7.tmp\SETUP.EX_

        Filesize

        2.7MB

        MD5

        1a59a8af3c58b30ff0fe71db2196b24b

        SHA1

        6b0e5ba36f4fc5328ec494272054a50cafa13e68

        SHA256

        ba25974b29a25cb7bc1f58a0990a8ce758354aa6ec5b8b8af210f2c1466ba49d

        SHA512

        f173fe15db8d7aeef4f6fa62a41246550ccee207e6388095a5f87036362d4c95da646e1a7c68764054556e024da80b749646425076e9bfac42fb77be8f2c0355

      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CE171240-57F8-4936-A1C3-1241542F4E53}\EDGEMITMP_D4CC3.tmp\setup.exe

        Filesize

        6.8MB

        MD5

        1b3e9c59f9c7a134ec630ada1eb76a39

        SHA1

        a7e831d392e99f3d37847dcc561dd2e017065439

        SHA256

        ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

        SHA512

        c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

        Filesize

        3.9MB

        MD5

        ad5f7dc7ca3e67dce70c0a89c04519e0

        SHA1

        a10b03234627ca8f3f8034cd5637cda1b8246d83

        SHA256

        663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31

        SHA512

        ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51

      • C:\Program Files\msedge_installer.log

        Filesize

        108KB

        MD5

        78cc23fb40ea905dc9c6ce7ac208f0db

        SHA1

        79418ff8cd578d8b7da8759ff4f12255612d1505

        SHA256

        363fabb4d1f79b440d8784c189e0b908c83a7f10b8aaa15ac14220bf9e6d82b3

        SHA512

        e42130f62229316126f8436992daefd9e1edcf3a8b09b875721a5686cf861ec1f7870935a5cfd4b52ee4e9e031aff998fc8bc1a91732079cb5b1951e839fc775

      • C:\Program Files\msedge_installer.log

        Filesize

        73KB

        MD5

        4dbb248a00fe0810b7ad257a76535dfe

        SHA1

        3170f4377ef231a9365bee425554e860a14f6865

        SHA256

        51f556cd9b11c7dd818d4aa7b1aec7348137d285df51dfcab59377215bfbfd9e

        SHA512

        29196f5ab7d4df09093664921d9ce773504387ee390deff9aa60fe10ec0d5649ac8817a99f17db76a889f32aaa74f219ceefe548be7f7c774a30436c692e888b

      • C:\Program Files\msedge_installer.log

        Filesize

        99KB

        MD5

        264a0bd58954502b704274129b37744e

        SHA1

        7009fb631f6685f57237e0c4e043ba1282bfeea6

        SHA256

        f5b26129297249badbbf892c50d5ac87999030b40e085c2c87db49bf78646f2c

        SHA512

        d40f28f70a6f419f239610d2116fff9b1e2b49a831fd0bf34a77f95ab10436ab74ae1c9e10ed00a188e02163332e7f6a3c0fc021fb37ed43da4d0f8b24eac2da

      • C:\Program Files\msedge_installer.log

        Filesize

        102KB

        MD5

        d875c7426587c5e3a26580c4c27f25a7

        SHA1

        19eefd4cea2b916f3ad3861a154560453f6fa170

        SHA256

        b07bae0fe1a55c98dfe9948bb5dd8ce594a165da8ed0a2576c3054b699ed6b13

        SHA512

        fac6cb99cb044dbe7a79298462f97a9fc1dc2093fe303a3e4b1c49df3821ecf331b1310a80d5294171755d2437919b41422a8b0d43032ada10aa1292a7375b49

      • C:\Program Files\msedge_installer.log

        Filesize

        105KB

        MD5

        c11a5c8638274b78f13991335c94abc7

        SHA1

        108798a8ce6fde0bcce1d9ded6cbf55fb9da99e6

        SHA256

        4fdb55d63c68d7906aa686e6933f19fa6586ea870432c9a365ce71948e299e28

        SHA512

        e84b286e0320ca4596cef7626583fb5be66f70ecfa92cbbd00241cf55a236c1c4b883f9d3a5f345f46b0c75acc99daf13fe09dcf073ec980d244416aa41e0e21

      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

        Filesize

        571KB

        MD5

        f6b353e8b1adc63ef10b8e6c12d280e9

        SHA1

        2864e0980a4577b08551c40f02f57fc093371dbe

        SHA256

        1fbd1e22bceaac22413b18dee04acedfb5390199026d03143422078714124192

        SHA512

        2d2581e499f0a648496a7309a20aac9fa8680536a5f48c5428af950306ab52ec2651e74c0fefbaea9b0d32150405287a28c2028303f74630a76a9109b08ca8ee

      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

        Filesize

        582KB

        MD5

        20dfc9fb7ecfdefa29a8a9783dcd4083

        SHA1

        6faa7457eab747215b9801dd6f8ad8d41d93e8ad

        SHA256

        ac91e5dfdd6921d206b5f7a6b96b476f1dc60bf2eae541cf2f622949b6312c6b

        SHA512

        a79ecdc08b31fa1815bc1061984b27b7f7978b8e92afee09b724708dc5e3f4eddec1c8444678a301bc59b3e5fc6d407ce9dcd65b0bf7e1a532f0c8512a7a595f

      • memory/2952-32-0x00000000006B0000-0x00000000006C9000-memory.dmp

        Filesize

        100KB

      • memory/2952-26-0x00000000006D0000-0x00000000006E9000-memory.dmp

        Filesize

        100KB

      • memory/2952-28-0x00000000006F0000-0x0000000000700000-memory.dmp

        Filesize

        64KB

      • memory/2952-27-0x00000000006B0000-0x00000000006C9000-memory.dmp

        Filesize

        100KB

      • memory/2952-22-0x00000000006D0000-0x00000000006E9000-memory.dmp

        Filesize

        100KB

      • memory/3916-12-0x00000000006F0000-0x0000000000709000-memory.dmp

        Filesize

        100KB

      • memory/3916-30-0x0000000000400000-0x000000000052A000-memory.dmp

        Filesize

        1.2MB

      • memory/3916-31-0x00000000006F0000-0x0000000000709000-memory.dmp

        Filesize

        100KB

      • memory/3916-5-0x00000000022C0000-0x00000000022D9000-memory.dmp

        Filesize

        100KB

      • memory/3916-13-0x0000000000710000-0x0000000000720000-memory.dmp

        Filesize

        64KB

      • memory/3916-9-0x00000000022C0000-0x00000000022D9000-memory.dmp

        Filesize

        100KB

      • memory/4080-103-0x0000021DE6670000-0x0000021DE667E000-memory.dmp

        Filesize

        56KB

      • memory/4080-104-0x0000021DE8B90000-0x0000021DE8B9A000-memory.dmp

        Filesize

        40KB

      • memory/4080-105-0x0000021DE8BC0000-0x0000021DE8BC8000-memory.dmp

        Filesize

        32KB

      • memory/4080-106-0x0000021DEA000000-0x0000021DEA249000-memory.dmp

        Filesize

        2.3MB

      • memory/4728-29-0x0000000000E20000-0x0000000000E39000-memory.dmp

        Filesize

        100KB

      • memory/4728-15-0x0000000000E20000-0x0000000000E39000-memory.dmp

        Filesize

        100KB

      • memory/4728-21-0x00000000007B0000-0x00000000007C0000-memory.dmp

        Filesize

        64KB

      • memory/4728-20-0x0000000000E40000-0x0000000000E59000-memory.dmp

        Filesize

        100KB

      • memory/4728-16-0x0000000000E40000-0x0000000000E59000-memory.dmp

        Filesize

        100KB

      • memory/4944-4-0x0000000000810000-0x0000000000829000-memory.dmp

        Filesize

        100KB

      • memory/4944-0-0x0000000000810000-0x0000000000829000-memory.dmp

        Filesize

        100KB

      • memory/4944-10-0x00000000007F0000-0x0000000000809000-memory.dmp

        Filesize

        100KB

      • memory/4944-11-0x00000000022D0000-0x00000000022E0000-memory.dmp

        Filesize

        64KB