39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
146s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.ServiceBrokerEnum.xml
Size

6KB
MD5

8b9153e2f28f69dfd5c700c717dfc5a0
SHA1

bf052506033674d26a0abf1858f6351e58bc10c8
SHA256

e63fd633020b5bd198fab9f70ffcfe5307bc36e46cbd2e84492b6037288191b4
SHA512

83425c651f30d0c039c35a90916d414cea72ddc9b1bddc5ef318d033d4b5d1b522611eb2b6dafbc97f7e84a4ce67f9f07887dca63093cfa87a00894224aab5ce
SSDEEP

96:9YAKCPeb//JXH//ztk/JDCx+ktV2zUpQzS/4Pq0dcEifWfU6fhHxf0oI9ftsfF9T:MjZTtk8Js8rY9imUahZiq7

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1016218523\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1514184164\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1514184164\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_310339899\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_310339899\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1655847755\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1514184164\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1514184164\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1514184164\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_310339899\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_310339899\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_310339899\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1655847755\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1655847755\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1655847755\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1655847755\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1016218523\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1016218523\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175415"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1307946658"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897013928498566"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437575798-4173230203-4015467660-1000\{FFB52E63-14DF-4FD8-BE97-7538BE86307C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4724	3476	MSOXMLED.EXE	78
PID 3476 wrote to memory of 4724	3476	MSOXMLED.EXE	78
PID 4724 wrote to memory of 2904	4724	iexplore.exe	81
PID 4724 wrote to memory of 2904	4724	iexplore.exe	81
PID 2904 wrote to memory of 4640	2904	msedge.exe	82
PID 2904 wrote to memory of 4640	2904	msedge.exe	82
PID 2904 wrote to memory of 4876	2904	msedge.exe	83
PID 2904 wrote to memory of 4876	2904	msedge.exe	83
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 4896	2904	msedge.exe	84
PID 2904 wrote to memory of 5036	2904	msedge.exe	85
PID 2904 wrote to memory of 5036	2904	msedge.exe	85
PID 2904 wrote to memory of 5036	2904	msedge.exe	85
PID 2904 wrote to memory of 5036	2904	msedge.exe	85
PID 2904 wrote to memory of 5036	2904	msedge.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.ServiceBrokerEnum.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.ServiceBrokerEnum.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.ServiceBrokerEnum.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffc95d3f208,0x7ffc95d3f214,0x7ffc95d3f220
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1764,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3412,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4844,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4740,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5900,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:1584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5172,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6104,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5040,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6384,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,9643919514785133277,17715988240670812651,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14
      4⤵
      PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
27d02a9170feb143c10bced3f0c7ad50

SHA1
0e807524dd428900bf3c6b91190740adb8e7e660

SHA256
f7b57a37dd1bf12371382fb12cd8f0ebb8cbc86323a10903d62014195e3142dc

SHA512
80723887c4cd5aa3847d68d3bbbfbaa29e1858ee08bfa2c51369c31e44eee1b627a2ae8cb1f2a5ce75a5a91d7ddfe4ce8f3dcc5da818e4f2dcbc2f746bbe9589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a652308-8827-4e70-8270-3b79e3d6e59b.tmp

Filesize
37KB

MD5
d7c1cea1c1b59892178dffba51eac9ac

SHA1
362262356e726ea2a710f728324eb267ddc8df6f

SHA256
7c59edbc564e59dbfa3f27e894dbf3d61c4fc9e37162356fc9f604986d1a45c9

SHA512
740a833f1f53a1f60b6d4de825b314ac252111bff30c531ef7bce802efbac2579dcb19227a3ea3b6667ead323fdf7ad9f8ba03d37f0148d09583a613cde821d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4c50d53d59db878243e524cba3438e71

SHA1
cdabf98df616c4a734f4595e51dc08b61fc41e80

SHA256
0b3289a808afb16ed4398dd28be197037f0be577620d9aff8da6c6dcd0e20fcb

SHA512
79d44391f8ca9275282172727f96a96171aefa3f0a18694ce1f22458bb6b3c6e591924404d4dd4bcce99a0854243c20bf67137c6ccb8bcf5635664090be36b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1b224b369b22b6650f671d45af468a6b

SHA1
fcfd21a1abc3f1b4fb4a833e1461113299811409

SHA256
a37ac63d78d0c2c40fd90984fc5ee72946ca0e25bc43516201ba7d4d401a3050

SHA512
33aeea5954dcca776d54e396018fb3c5434f5bd1adf80828236aab79f63c15decfa64f55b862b025ae51101a909a8e1ec08e61572a05196a5edd2ece36b16361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
616a043edf19f8aae8f6a342289dd8eb

SHA1
950edad9e3a9cadfa9c3eb416f0540941c8161a0

SHA256
263d809f9d8419e9a30331a432b828e64796cefde0b1ec98357cc6d31e053709

SHA512
bf56772035f8ae173f5372647ec291341addf408fc5d155b400484090a6b81bfe5f469d91d4e656204c7783b8ab866c50f34cb9449f54b0ea4a7d5c1ea5330e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
287082611adeb6a42250330cc736c487

SHA1
b34f9e8f165fae4ee20d09ad22c88efa5ebec287

SHA256
59774ec1bce9c2a97e0381e9de302930882d1537dc84da4ba7b2f2308b95c828

SHA512
25697123facb1fcfca05e02438ef5f25ea757a43dafb26044a0e47fe1b9d8346ed617573253132003e0535bd527a7120673ca00119d51a47bc760004a6ac96d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
b62a40ddc8abadec04c2f2f442ecc832

SHA1
54da76273a32c2ce46362bb403ca9fdac5786dbb

SHA256
1dd6f644f8e59361f5e50a0a4d64467da53a8877ee08fcf05aad20547832d002

SHA512
abb8e3f66076b5342a08004274d3730e36003dc0fc847760f92ac26ea1539dabf80bfe6d0e3c8c0ac9e1a44df973b33dcba01dce90fa1e6b67e538cee1cf833f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
898B

MD5
83861d05d34e98481bbd24d96778eeeb

SHA1
8748358ec498339659ba099940143c6e306f83e0

SHA256
29b362e023a706c8aa8a7eda3fc2873bd4f396c1be5f34fb2af0aa5102584827

SHA512
92575f8603cccd0e7a6a70a6186e2eeacd7b6b033659255d06d1211d6ca3a0befd173183e31068d4824e7ac07da7d40c579a5d92de4183af0c83bd2a0dba7ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
010d5583f5a757f322376addd25e8f0d

SHA1
d51ee5fd1db4d30ad1784b0a8748ea445e7bc49b

SHA256
138d41f78e7c1e5b8140e3526b58acc35228e5682359767677117cdc4061e332

SHA512
d597bb461d7bdbf64f98d4e5e985705f9e073aee80254a67e866d2a11f894a8cdbec7445292212478cd8180b8027561e8c6877fc6ba998aea0ce44c467ed76ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
035adba99ebc171653eabdd8ffb8604a

SHA1
77c89babf4bf3269249d40a0bdedfcd2bae21a94

SHA256
68d346b4c88a5cff2886b080e0f04ec680830da03c5239610237780dde96e138

SHA512
de6122e15d5e667de875dac9f7b3dd6b9f0544439418d4c2cdda9e8ca07d60caaae409ef04c7bed0c2c46c6324973609662e2a42b40cbe6bbca483ff2900f45d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b81ad60a99bb3606ab20494493aaa25e

SHA1
553df60fe5407e3694455f199b4def641131ce78

SHA256
010cd57a937c0f67d72a0496328f4f6b1905b80fe8b1f415e0f2c848e1f90b73

SHA512
1151125f5448de00084c2166b68d317c1a33cd398330bf060bb7dc2e2990f45d77e31355c844dfff5580594ac74fbbf3d379f377061040075a3385cff5d19590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
07afbc282188674f1ad8b208e0a7c595

SHA1
725510c6591a2a4ed79ac9e70a15ceb1f209edb0

SHA256
fd22daab965e4139cbd1daf4a80905cdc6d67c71ebf4c4f6235f2042bc3961a2

SHA512
5fc6552586786ba82d87ecb875e4f1fbd7fa533e94ed3d113c94f7eb6c584393b77f092419a9b8dfe4a92ad4fe33c4c552a9e932ac1b5060f585a4f6e9d4cdf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
4469377cea0ad8a550176af532c2a9a3

SHA1
d7aa5814beedba5acde0d875fd0f59fe5e95e6fb

SHA256
240ad0c6c0f96e172ae6f414840c634ab732f2a2fa8a2c48cce6ac9dbc5feede

SHA512
6dbad23f7b907bafdcd653ac3c2fc21f28d774c28b2f594255360928450c53266cc83a35b5f53495b5058c2f3d46d03e575f179bce3c9fd8a3c1ab18f716b31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb

Filesize
623KB

MD5
b5467605f1d5600fe6d540ebbad3c3a7

SHA1
4c52cfde3375a6fee3c1bafc6deecf77015ab154

SHA256
f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1

SHA512
0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1016218523\manifest.json

Filesize
118B

MD5
03e6b705075692ba847a04282c612238

SHA1
c49e349819bc7d2ce591fbae49377d11baebc943

SHA256
afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a

SHA512
28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1514184164\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1655847755\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_310339899\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_310339899\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/3476-3-0x00007FFCA53E3000-0x00007FFCA53E4000-memory.dmp

Filesize
4KB

Download
memory/3476-13-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-9-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-6-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-11-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-5-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-2-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-7-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-0-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-4-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-8-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-14-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-10-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-16-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-17-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-18-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-1-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-19-0x00007FFC653D0000-0x00007FFC653E0000-memory.dmp

Filesize
64KB

Download
memory/3476-20-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-15-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download
memory/3476-12-0x00007FFCA5340000-0x00007FFCA5549000-memory.dmp

Filesize
2.0MB

Download