rhadamanthys | 143a401d4b53578aaa517cefbf94997c9862c58b87de79eb2d00b203cbbf7ad8

Analysis

max time kernel
99s
max time network
93s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250410-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
14/04/2025, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Deushack.exe
Size

35.9MB
MD5

5c968b2507b72eb3c15b11eac7f8e852
SHA1

9d88d858047f2e6153c7b7c4dbb9bf0674ec6929
SHA256

143a401d4b53578aaa517cefbf94997c9862c58b87de79eb2d00b203cbbf7ad8
SHA512

69282d30afcadb5e9e3d57e59a84bdabfd0a9988e97a9dd674a857f5d3f8035af084f0b62d0cf8d6c6c0bfaccbb9a554dc994e7990f2d4b676a88dfdbf9c1c2b
SSDEEP

393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4VfvNqFTrYa

Score

10^/10

rhadamanthys defense_evasion discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 1 IoCs

resource	yara_rule
behavioral2/memory/948-26-0x0000000000400000-0x0000000000522000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 948 created 2980	948	MSBuild.exe	51

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	1120	Discord.exe

Executes dropped EXE 2 IoCs

pid	Process
1120	Discord.exe
4844	S5MBTA8V.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4844 set thread context of 948	4844	S5MBTA8V.exe	92

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133891352153436511"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1281280933-2069278784-2911492150-1000\{1760B1A0-0ED7-4B63-8BFF-EF531D8485EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3088	powershell.exe
3088	powershell.exe
948	MSBuild.exe
948	MSBuild.exe
948	MSBuild.exe
948	MSBuild.exe
3188	fontdrvhost.exe
3188	fontdrvhost.exe
3188	fontdrvhost.exe
3188	fontdrvhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	Discord.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeIncreaseQuotaPrivilege	3088	powershell.exe
Token: SeSecurityPrivilege	3088	powershell.exe
Token: SeTakeOwnershipPrivilege	3088	powershell.exe
Token: SeLoadDriverPrivilege	3088	powershell.exe
Token: SeSystemProfilePrivilege	3088	powershell.exe
Token: SeSystemtimePrivilege	3088	powershell.exe
Token: SeProfSingleProcessPrivilege	3088	powershell.exe
Token: SeIncBasePriorityPrivilege	3088	powershell.exe
Token: SeCreatePagefilePrivilege	3088	powershell.exe
Token: SeBackupPrivilege	3088	powershell.exe
Token: SeRestorePrivilege	3088	powershell.exe
Token: SeShutdownPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeSystemEnvironmentPrivilege	3088	powershell.exe
Token: SeRemoteShutdownPrivilege	3088	powershell.exe
Token: SeUndockPrivilege	3088	powershell.exe
Token: SeManageVolumePrivilege	3088	powershell.exe
Token: 33	3088	powershell.exe
Token: 34	3088	powershell.exe
Token: 35	3088	powershell.exe
Token: 36	3088	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1624	1172	Deushack.exe	84
PID 1172 wrote to memory of 1624	1172	Deushack.exe	84
PID 1624 wrote to memory of 1120	1624	cmd.exe	85
PID 1624 wrote to memory of 1120	1624	cmd.exe	85
PID 1120 wrote to memory of 3088	1120	Discord.exe	86
PID 1120 wrote to memory of 3088	1120	Discord.exe	86
PID 1120 wrote to memory of 1768	1120	Discord.exe	89
PID 1120 wrote to memory of 1768	1120	Discord.exe	89
PID 1768 wrote to memory of 4844	1768	cmd.exe	91
PID 1768 wrote to memory of 4844	1768	cmd.exe	91
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 4844 wrote to memory of 948	4844	S5MBTA8V.exe	92
PID 948 wrote to memory of 3188	948	MSBuild.exe	93
PID 948 wrote to memory of 3188	948	MSBuild.exe	93
PID 948 wrote to memory of 3188	948	MSBuild.exe	93
PID 948 wrote to memory of 3188	948	MSBuild.exe	93
PID 948 wrote to memory of 3188	948	MSBuild.exe	93
PID 1172 wrote to memory of 1328	1172	Deushack.exe	96
PID 1172 wrote to memory of 1328	1172	Deushack.exe	96
PID 1328 wrote to memory of 468	1328	cmd.exe	97
PID 1328 wrote to memory of 468	1328	cmd.exe	97
PID 468 wrote to memory of 1780	468	msedge.exe	99
PID 468 wrote to memory of 1780	468	msedge.exe	99
PID 1780 wrote to memory of 5028	1780	msedge.exe	100
PID 1780 wrote to memory of 5028	1780	msedge.exe	100
PID 1780 wrote to memory of 1840	1780	msedge.exe	101
PID 1780 wrote to memory of 1840	1780	msedge.exe	101
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102
PID 1780 wrote to memory of 1884	1780	msedge.exe	102

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2980
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3188

C:\Users\Admin\AppData\Local\Temp\Deushack.exe
"C:\Users\Admin\AppData\Local\Temp\Deushack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFMAeQBzAHQAZQBtAEwAbwBnAHMAJwA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3088
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\SystemLogs\S5MBTA8V.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Users\Admin\AppData\Local\SystemLogs\S5MBTA8V.exe
        
        "C:\Users\Admin\AppData\Local\SystemLogs\S5MBTA8V.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4844
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start https://t.me/DeusWinbot"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/DeusWinbot
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://t.me/DeusWinbot
      4⤵
      Drops file in Windows directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffe8d12f208,0x7ffe8d12f214,0x7ffe8d12f220
        5⤵
        
        PID:5028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
        5⤵
        
        PID:1840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2568,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
        5⤵
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:2992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4224,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        
        PID:2988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4260,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
        5⤵
        
        PID:2064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5336,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
        5⤵
        
        PID:3504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3676,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
        5⤵
        
        PID:700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3564,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5640,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
        5⤵
        
        PID:1820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
        5⤵
        
        PID:2096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
        5⤵
        
        PID:3896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
        5⤵
        
        PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6288,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
        5⤵
        
        PID:4264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4232,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
        5⤵
        
        PID:2052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4228,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
        5⤵
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4276,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
        5⤵
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6776,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
        5⤵
        
        PID:384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6640,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
        5⤵
        
        PID:3156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4220,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
        5⤵
        
        PID:3496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=600,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
        5⤵
        
        PID:1172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4300,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        5⤵
        
        PID:2848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4288,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2032,i,13732641918989286369,17747670037165267505,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
        5⤵
        
        PID:32

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
6e82345aefe362b4c5071e7df6c07407

SHA1
44176a6b5c2722280699b8cc9a174d168fd4c161

SHA256
ee1ec48b6b166582c51a4141a84f48731ce18a62e4b7faeb9d60560c8f9c382a

SHA512
20c0f5862226a3eb17832e7c793f809f2333e0e0068dbe61b5865517fdd9f84bb5ca8d97bdb19a005a25b789ac75a09067350940f042fb5123cdb682ce2c98d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
6a8263dec89363fb9293041252880074

SHA1
f1a3dec010e7971f902ae2f3dd7b9297128e73b3

SHA256
8bc37b6042b4255af274e1063445dbf9e5c23110ab10bf535fddedf228cb86c6

SHA512
882c71f063999cf6c5fd3c00a0d39b3f32fdf3e647a0c5eab48c2271784c77d611181b498b995ae57aa0c55c13825059a25cf47596c6e8530c20b5e3fab718d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
14a9c06d930c38533168ea14d8bfa65c

SHA1
c2c1085ccb2fc126ed4b54bbfdd6dee953a9a29a

SHA256
dbad30d6bdf1b0e16e387353b25f5accdd209f092e677b9d12a31575a6d98046

SHA512
beb8d5d40113ec2a3c5317fc770b2c3e1877051738141782d225e6fb1f4b0751c9e7c5f814e12a83b33bbb72bd50e32b41c4e5594f12f1d30558fc348560d37b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
4dc5e90f5a0d05072cd66f51c136dbea

SHA1
121c01e2838dce0bbce09b876db9eeb6139b9e5c

SHA256
00d2cf9a6df363d99787993dd113b43a9a32812139ee0d491cba26f3c074dce9

SHA512
7300f4d7bc3a00e730e44e7e0555975703998497f2c26b61a4b8499ac04853d512938009663ec3bbf3a1b38f853a2955db42f4ea683276ef3e55089a954bb3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
8c99c22646dfe639db2cc120662b541d

SHA1
18ee785f099a8149278f6add27f2a41e7dbeaf5e

SHA256
382f19728ca84ea4c02066f18c4900ffeec46e140d03bc64ff60ae717672d4cc

SHA512
3be498092acacd630d3b763ee4d259d1841c582c0be9ef391690c57cf4714aa4946423f83f95e883cd37ef49f9859414adf3021d86074dca2e03702e32f05b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
3364a0737076ec276ac5e10e6c766129

SHA1
6ac88399d62740377fc1119f9860feb4f7107413

SHA256
7fa7eb9192c160dbf26fd082d5c10ff02442f546e2590d3c8993d93648f4da8a

SHA512
cc5ee7111b928e02a5df04212818935560fbdd3977045072ceaaa9f2ef2edbeaba7f4619e0ce612cbee2859592b7b626365794516f33ca1bfd1bc7171e87cc9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
880B

MD5
bf91e93e5196c1894b9da8d98c6a7617

SHA1
ff813c0f8cad7f1021d7d2edb59e838a32e1f329

SHA256
d7024943cf7f026c03a78002492483d03bab9b379ecb28523916bb25d0a87c44

SHA512
36e69f3d94009f3ca22afeaa14c359e24f810039b65bc743b8a81611f8c8ae473bf9640ffbce059f3e0bcdd3661ec29b183c42802b7772bf83465e8f787ec486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58fd37.TMP

Filesize
469B

MD5
0d907bc02e2744d50fc576ee1d312e62

SHA1
ee1a84866013811211bbbd92a5d7ff87ee291e9e

SHA256
ace793279d77163c0f0d89488f507668893d8b318c2bad4ad1a60b24217a94da

SHA512
8b1ede1bcaaf546190ba3e0540c769edb6833dc37e830df3b0af9e85a0ceea403e21b7ae696c13b87f412742faaa0cfa83001a27e83570daaf5e3115f3b857bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
10d7379ade9997293fc76e1025ccaf5f

SHA1
73f3abf31952f55c25623ab9265e64af5b1aaed3

SHA256
0d931684fd343ae853056dfbc6b48966055cbe3a52fe3b6dae5b2da3c64407b8

SHA512
c7bc632ab33a2281ba286294302ff3378c17b2d179a66f9956ec46b700c0a843a15f1566bc60f1f03661598cedc846963e3474f52eb66f12857a926d0bb44800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
0cc79540bcf50a67c9b3b1aca0d8849b

SHA1
c0754e9d6fee74fabc85781490b4b5960aaf6fca

SHA256
5b40168c4c85182453ea8f894159a795a44a52a6c44cdd1a49124634abcd21a2

SHA512
6ce658b4cd2583d3445eae38058b9399b78efb6cd41a32bbeef8137b85f9fa6d0bb758f2f094d0c555c35e9da9d2bb9ce7825c6cf3811382623df07f8266def3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
07721de194edec107b040948ac4b6dc4

SHA1
d90e10609b2e4e2ff5106672d1044bf580581899

SHA256
8c7c7500d775a1dad432baab1a3d23cf6ef70bb9aedd8e284a5e2153d4312627

SHA512
c4e43f76a27a0c0488a9e862bb50aa42385eaf3097d6773b82f856c8fcffb7e08c0a4cc23de76658e5d7cbf03c52c9d581c9aec6ce090b4e720622e85332aa49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
494aa8cfbc757b9095031a2eed1bb464

SHA1
488be846e886efc381e8418871f4f9604f11975a

SHA256
ea55bf572c0837858829b1e7efaea39676131f75fb3ef58a1008750e99dc8473

SHA512
78def59816d00f48fe7e7ad7b13c5fab863441a1a46ad41444283b1c092c091139b26743b709b5d76f63ab269bb4d43aa819f635fe0da5fa056069e9828d178a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
b3aefcac4253f42b9d6dac887494c214

SHA1
21d3fd841a609af9780d5547ae3444acfdc24324

SHA256
00b2256ee291157c638073df94a01472d62697cce986207915bf2e298eefea90

SHA512
ac96b0824781fc32c8bc9ba41999869536d6444da41a4e7f36303e35d1f5249745525f7d5fe0ded767ba39af8bf8a18166c5fa4c8da8b6c8837b748d29099d7b

Download Submit
C:\Users\Admin\AppData\Local\SystemLogs\S5MBTA8V.exe

Filesize
3.2MB

MD5
989a61c1043f1267095a8bb396500830

SHA1
235d3eb42c6c66d71777d927a42ba4db33c205a4

SHA256
bfe8a764e4c82d2cb74a80df209069295fb85b2e458eee2ea3b2bf8da55bb363

SHA512
491275f8f5c76a0a9793265b9b8fbb591058920e3c9936396677dd4215dcadd8a594fd4f428991371a768a97270d04c633e46d6e82bfed5623caa7f9cf65c6d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a9111b1-1529-4a97-ac33-54b951b3ef31.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe

Filesize
7KB

MD5
a46b45489799bdc265a0d66c1bbaa374

SHA1
58bdd58c9fa884da0ce7e469f41d20e338175083

SHA256
88fce138c5a8010178facb5b724c198c8d7e539d9a9e60a949fcff9df82c4743

SHA512
97abb207c41f6172ce45dcba0f18914fdda7af35740cbc369a2f9d3c0fbfdb6561542bcac6c83316ee881d09239f61d1b68d7f6fb67d7ca0b3cc4fa460689dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ia1brz3i.rvh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/948-28-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/948-27-0x0000000001440000-0x0000000001448000-memory.dmp

Filesize
32KB

Download
memory/948-26-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/948-29-0x0000000005340000-0x0000000005740000-memory.dmp

Filesize
4.0MB

Download
memory/948-33-0x0000000075660000-0x000000007589A000-memory.dmp

Filesize
2.2MB

Download
memory/948-31-0x00007FFEAAED0000-0x00007FFEAB0C8000-memory.dmp

Filesize
2.0MB

Download
memory/948-30-0x0000000005340000-0x0000000005740000-memory.dmp

Filesize
4.0MB

Download
memory/1120-22-0x00007FFE8C8B0000-0x00007FFE8D372000-memory.dmp

Filesize
10.8MB

Download
memory/1120-7-0x00007FFE8C8B0000-0x00007FFE8D372000-memory.dmp

Filesize
10.8MB

Download
memory/1120-6-0x00000224F67B0000-0x00000224F67B8000-memory.dmp

Filesize
32KB

Download
memory/1120-5-0x00007FFE8C8B3000-0x00007FFE8C8B5000-memory.dmp

Filesize
8KB

Download
memory/3088-9-0x0000012BAEFA0000-0x0000012BAEFC2000-memory.dmp

Filesize
136KB

Download
memory/3188-38-0x00007FFEAAED0000-0x00007FFEAB0C8000-memory.dmp

Filesize
2.0MB

Download
memory/3188-40-0x0000000075660000-0x000000007589A000-memory.dmp

Filesize
2.2MB

Download
memory/3188-36-0x0000000000A80000-0x0000000000E80000-memory.dmp

Filesize
4.0MB

Download
memory/3188-34-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download