danabot | 9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef

Analysis

max time kernel
294s
max time network
249s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
05/03/2025, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B6F6C74F86A145460F03AC3A0520D3345FC7FCC1.msi
Size

8.9MB
MD5

e1438c21e6de91615a6a5e2a48f274fc
SHA1

b6f6c74f86a145460f03ac3a0520d3345fc7fcc1
SHA256

9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef
SHA512

9be5f304259a2bbc488cde3a9a5cf09b2019a14e32538d79e88e3d1785bce5a3dcfca6702d235d5ec87b4bdf043f3c6a41762ccc2ba6fed8ee63366c0f2e0879
SSDEEP

196608:9n520ZroZkRsj6N+gdC1fcmwz/MIpqPuJS8ErZ/0jCi:9n52eSFjG+aAfcRo4Kz8W0j

Score

10^/10

danabot banker discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
5059953BB045843A520147F73664DC78
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 5 IoCs

flow	pid	Process
12	4280	rundll32.exe
20	4280	rundll32.exe
21	4280	rundll32.exe
22	4280	rundll32.exe
23	4280	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF15D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1C687FE1FD28952C.TMP	msiexec.exe
File created	C:\Windows\Installer\e63ef18.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e63ef18.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC84DD494D3BE88D5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF16D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF237EDC0C02BAA7D1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF77B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{27B611CD-7B17-41F6-B60D-D59C81B6D3AC}	msiexec.exe
File created	C:\Windows\Installer\e63ef1c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF77A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4778E9627C869464.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0DF.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
5044	MSIF77A.tmp
1572	MSIF77B.tmp

Loads dropped DLL 6 IoCs

pid	Process
4844	MsiExec.exe
4844	MsiExec.exe
4844	MsiExec.exe
4844	MsiExec.exe
4280	rundll32.exe
4280	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2076	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIF77A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIF77B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2344	msiexec.exe
2344	msiexec.exe
2008	msedge.exe
2008	msedge.exe
4608	msedge.exe
4608	msedge.exe
4944	msedge.exe
4944	msedge.exe
3200	identity_helper.exe
3200	identity_helper.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2076	msiexec.exe
Token: SeSecurityPrivilege	2344	msiexec.exe
Token: SeCreateTokenPrivilege	2076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2076	msiexec.exe
Token: SeLockMemoryPrivilege	2076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2076	msiexec.exe
Token: SeMachineAccountPrivilege	2076	msiexec.exe
Token: SeTcbPrivilege	2076	msiexec.exe
Token: SeSecurityPrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeLoadDriverPrivilege	2076	msiexec.exe
Token: SeSystemProfilePrivilege	2076	msiexec.exe
Token: SeSystemtimePrivilege	2076	msiexec.exe
Token: SeProfSingleProcessPrivilege	2076	msiexec.exe
Token: SeIncBasePriorityPrivilege	2076	msiexec.exe
Token: SeCreatePagefilePrivilege	2076	msiexec.exe
Token: SeCreatePermanentPrivilege	2076	msiexec.exe
Token: SeBackupPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeShutdownPrivilege	2076	msiexec.exe
Token: SeDebugPrivilege	2076	msiexec.exe
Token: SeAuditPrivilege	2076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2076	msiexec.exe
Token: SeChangeNotifyPrivilege	2076	msiexec.exe
Token: SeRemoteShutdownPrivilege	2076	msiexec.exe
Token: SeUndockPrivilege	2076	msiexec.exe
Token: SeSyncAgentPrivilege	2076	msiexec.exe
Token: SeEnableDelegationPrivilege	2076	msiexec.exe
Token: SeManageVolumePrivilege	2076	msiexec.exe
Token: SeImpersonatePrivilege	2076	msiexec.exe
Token: SeCreateGlobalPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe
Token: SeRestorePrivilege	2344	msiexec.exe
Token: SeTakeOwnershipPrivilege	2344	msiexec.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2076	msiexec.exe
2076	msiexec.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4844	2344	msiexec.exe	84
PID 2344 wrote to memory of 4844	2344	msiexec.exe	84
PID 2344 wrote to memory of 4844	2344	msiexec.exe	84
PID 2344 wrote to memory of 5044	2344	msiexec.exe	86
PID 2344 wrote to memory of 5044	2344	msiexec.exe	86
PID 2344 wrote to memory of 5044	2344	msiexec.exe	86
PID 2344 wrote to memory of 1572	2344	msiexec.exe	87
PID 2344 wrote to memory of 1572	2344	msiexec.exe	87
PID 2344 wrote to memory of 1572	2344	msiexec.exe	87
PID 4608 wrote to memory of 3468	4608	msedge.exe	90
PID 4608 wrote to memory of 3468	4608	msedge.exe	90
PID 884 wrote to memory of 4280	884	rundll32.exe	91
PID 884 wrote to memory of 4280	884	rundll32.exe	91
PID 884 wrote to memory of 4280	884	rundll32.exe	91
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 1516	4608	msedge.exe	92
PID 4608 wrote to memory of 2008	4608	msedge.exe	93
PID 4608 wrote to memory of 2008	4608	msedge.exe	93
PID 4608 wrote to memory of 4696	4608	msedge.exe	94
PID 4608 wrote to memory of 4696	4608	msedge.exe	94
PID 4608 wrote to memory of 4696	4608	msedge.exe	94
PID 4608 wrote to memory of 4696	4608	msedge.exe	94
PID 4608 wrote to memory of 4696	4608	msedge.exe	94
PID 4608 wrote to memory of 4696	4608	msedge.exe	94
PID 4608 wrote to memory of 4696	4608	msedge.exe	94
PID 4608 wrote to memory of 4696	4608	msedge.exe	94

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\B6F6C74F86A145460F03AC3A0520D3345FC7FCC1.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 992211438BD289095F3F801EFB2D9F0F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4844
- C:\Windows\Installer\MSIF77A.tmp
  "C:\Windows\Installer\MSIF77A.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5044
- C:\Windows\Installer\MSIF77B.tmp
  "C:\Windows\Installer\MSIF77B.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\" C:\Windows\System32\rundll32.exe "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1572

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc8b7d3cb8,0x7ffc8b7d3cc8,0x7ffc8b7d3cd8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4800 /prefetch:6
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,12018173670528586278,3034892158329496098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e63ef1b.rbs

Filesize
897KB

MD5
2852f0853b8cb8a710a782712d9505f6

SHA1
90f05549bb71f2ff52c3dda71679ec6443ed8502

SHA256
17616c953bb0827829615551c12bda0a1099cae0670da9cf5ecd797e67fcf052

SHA512
afbfa9374add466fc80e78da4746087e2f2b0b882c1cfa80b40c6da4b3114f36f6e036028630c937e4becaa17f4914857137d5e121c5d74ad3033ddd5561b191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a1ea058d6231b47f5bb8557adba13351

SHA1
111dbb6ffff6517e11719a20683fd7f4ef0579d2

SHA256
f5a91a0770c54a1601557b8babfcc7813972275da171c384cc8929d2910a851f

SHA512
e613f481c50b5a7022a763d13ac1b1ebb6a9d4d973de95108d95d23844d9d526d8c90f391493f043e86e22e9a5abd8a3a4cab5f2def248033d0eb9421091889b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46ec2d399c9d10a0545cb514e47de14e

SHA1
98fc6f3f34f4082b8d81cc50dc571ec06eb454ca

SHA256
f50fff32b15e4b61c3cb18655c3daf46a83556aef1f3ff8d9ed074f298f247a5

SHA512
993b723da7b0ffcaa731a1f06057bf2ebdc2fd518ef8765b4f625b9fd0094cc6abdccfe998d0e6cb760a3e5d6c411b197a47e67c1de5a6ec4315d017a552a2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d6a6d9bc1e9f10bdc09ca34c4abe889

SHA1
25b2c64b17260fd44bf8a3484d5d69437c1eb4a5

SHA256
961362057a3c734dabdeb690174d17817c80a5395764c8a970dcfb9acc4ef272

SHA512
c845b25da13c374326e6edadb69158dbba757145ce1713f1aabd8b0520048735155888970711315555e261f147f986e0e7bd2c6b9c651c8d2e7b91ba5be2e2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4ecfc4407aecb8944de519f7fc231479

SHA1
4df37bbbfd51855b41fd48bf808fd7b86710a7d1

SHA256
0169d8d9631e8485e4d0aa6db1e7955db7b33044559720c89eb4779ef8e2eff8

SHA512
720090aef1e16273387e12b9d9cc3b68fab409ccae412453ff3e58fe9ae4a6b1b096df6688d7e7f7065382277c5ae42ee3467966e5df867ad418afcd3d77af80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
781a30b250738628fb6a8a85c16705f2

SHA1
22473206e97a7f16af0a4d1baa2bdc14567a68e9

SHA256
2e5f0f7cea47c1c63ef4a33306efdd92a27cb3718bc24d46d2f5be8ad03712dc

SHA512
2db82dd6672834868d21a8d86417db2807e1fefac384a0bd45908ad1dfcb97cde7445940b36cc1c5b64043eb6bd0b060c908e57dc54682a12b8b5943053e203f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
757748ba21cb8cfd73a4e715d9e32bb2

SHA1
3f40f43e185ab433795fc01e605dfb036485936d

SHA256
dadeddc11889e447d213d1c3f1ce6bfde4af55095e8e70d1e67c7bd0a1b99de4

SHA512
ba654237ad2973862883e5893596ee269d7f6f70352e38a5ddd09a92e046795326e4aa7f0c633cef0c3f7d3df4ba69c42b27ba5e9268406502a1828818dda26d

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\Launcher\TypeFasterPortable.ini

Filesize
203B

MD5
a3405b7d94dd1e19fe6a5aef21d93111

SHA1
5ba4ff637232dd35d88de1112ac302775cb2c2cd

SHA256
204e328badd4b673662bf7540e6eedcf4e17ef500381df36e25071fb9cf1d505

SHA512
dedcfb351326b0bd9abfc424e9c381e462282135a10720d263b8367b59782f1fd4645314cab210c14621ae61ab809a0af4d8a79171c75b0d90ba8698c9ab909a

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
272B

MD5
6a3660855c3132922543ce4cdf552999

SHA1
5025a8eb877abb57452fbb1217b7659e6778adaf

SHA256
e2ce1ac183d74e4d233fc2117a44f2aeb2dd4c7ef4f12d4797a76cc98007f505

SHA512
a2232e4dde8deb2b32890114f3da05e0acf21490fec2846ce050c03f0314e32bae1ef72e145d112509fc90986d437f3df0f1cae0f776ff6002242dd46d7da216

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
375B

MD5
6fdf7a0ab6ffe1301ae4ba82e64e3e2c

SHA1
3ab1c55265b1bc4af1be07af8fe979f536b7eeab

SHA256
27543dcc0018bc250287343ea852c9e046d3ed15cabaddd4c610d323ce7e246c

SHA512
b0e26302e94a05c406139ea6f596226cb4a59816cd96dad92ef1de2cdd6b224b3bcef2236180b167b63acb595cbe802fe095bbb1ba270a16e1bf196a0dbde54e

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
506B

MD5
92e001b080fbff760048c06fc997343e

SHA1
a6bceb0fbf356aebc37ab7049bbf3f7ff9aae238

SHA256
3fc2a187e6fa4994ad6994fd4ec5b8241d33b01eff3a2fceaaa6a0fa5596fe15

SHA512
c1ea92f85eb42505a44bdae5ce458f7ea0e074ccf3352f12f15f54cd43dcd7d0956ca531f0b779b9b8395e875d1a5b93d69c80a3d6010d8bce01c0697fdfca56

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\pac_installer_log.ini

Filesize
551B

MD5
9afa4d76710c10fccd6769fa23b5b695

SHA1
b10f230a298e0cca3353ee3385f06a41194dca7d

SHA256
ff25900b37e613614d57aec89d8286291b6256bac56e90bbfcb5f1cd3d843807

SHA512
05cdfb9319eb4145f6c663d8383e50116bd98eb905855a8f90ce695c3a5cfb46dcd31b40c5b2794d64dbed4a308f1c67d659365980383d43774ac3c6583cc777

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll

Filesize
7.7MB

MD5
043dae1b817ae561da9d6654b6354696

SHA1
a9f62f9ca8faa6023c4ef755d3b1f5aed2914516

SHA256
9de78011f776d2f3c963c6c3f77bc7af98ac51b4dbd11350850a8416bf767c36

SHA512
b7b44df89e93de8f31a35a22ed7b2d292cbad83ef564281af8e50aedade2f3ed4560b1e2ee9d91a5f1b270c407eafbef0f983895f8ed6651428ec5fe7389198e

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf

Filesize
19B

MD5
138994255ba043be1c37715fd931b1f3

SHA1
a39ed185ae5c91a59f9ae7bddce84cdcccb766cf

SHA256
6df84c79758b9f79709bd9292563dbda3fc7c726180ec6d394dd4e54b4427beb

SHA512
b26f7ea2c106852044b3a014ea91555a50ba43d4305a61c796926718da78d7dce335e9bb9613f0275ede4c961cc49f9a38e4bd59cc1504ba28457b364e3ee0cc

Download Submit
C:\Windows\Installer\MSIEF86.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF77B.tmp

Filesize
418KB

MD5
dd31c60eedf38fe4704ac9293614afee

SHA1
48b7ad49bfcba2906834324548e731729ead34bc

SHA256
6e8b9a6e7497d88421fa446ec1c2312fcf61d7f340364c61bd02b0bb4684b94f

SHA512
66f4642b3c0a92c2fc8e7cc7d0a61e7132d5193b90b7d4b2554a4a7bfff0fd990b47157d1f2af05ed177dc7dc920984f56b81e114e17de389d20fa5e51fa19e9

Download Submit
C:\Windows\Installer\e63ef18.msi

Filesize
8.9MB

MD5
e1438c21e6de91615a6a5e2a48f274fc

SHA1
b6f6c74f86a145460f03ac3a0520d3345fc7fcc1

SHA256
9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef

SHA512
9be5f304259a2bbc488cde3a9a5cf09b2019a14e32538d79e88e3d1785bce5a3dcfca6702d235d5ec87b4bdf043f3c6a41762ccc2ba6fed8ee63366c0f2e0879

Download Submit
memory/4280-591-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-605-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-606-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-602-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-601-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-626-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-627-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-628-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-629-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-622-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-603-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-604-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-586-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-585-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/4280-630-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-584-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-572-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/4280-647-0x00000000029F0000-0x00000000031BC000-memory.dmp

Filesize
7.8MB

Download
memory/4280-653-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-542-0x00000000029F0000-0x00000000031BC000-memory.dmp

Filesize
7.8MB

Download
memory/4280-727-0x00000000029F0000-0x00000000031BC000-memory.dmp

Filesize
7.8MB

Download
memory/4280-729-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download
memory/4280-730-0x0000000003A40000-0x000000000458B000-memory.dmp

Filesize
11.3MB

Download