39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
146s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.Smo.xml
Size

5.9MB
MD5

f06d9b6ad7e9099d4115000f3d56b297
SHA1

1b65c789dc67fb84d865edc3315eac67a33a7b49
SHA256

b98e083be658dd8c1ed03e8ab546f3f6dcfaa6c1e9742f57ad6c555becac18ff
SHA512

fb7e03620c597ed1739091b8b6f69c6cfdfcd632461f00650645389bb113f30b6c6c8f46b0cba4f045bf609a3138feab76acef186f192789dc638d6aece2f2ec
SSDEEP

49152:v1zGPohIw6hcxSwBrdswdEdmN3K6LLtmkm8XmkmKmyFZ3CCCydCDCByLo7IOcONC:o

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_188309421\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_188309421\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1957287188\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1218697479\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_188309421\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_188309421\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1957287188\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1843584283\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1843584283\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1843584283\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_188309421\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1957287188\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1957287188\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1957287188\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1218697479\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1218697479\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1428928546"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175345"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897014073788787"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2787523927-1212474705-3964982594-1000\{36056921-CEB5-4042-B10C-8C8384D6863A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 4056	5968	MSOXMLED.EXE	79
PID 5968 wrote to memory of 4056	5968	MSOXMLED.EXE	79
PID 4056 wrote to memory of 2084	4056	iexplore.exe	82
PID 4056 wrote to memory of 2084	4056	iexplore.exe	82
PID 2084 wrote to memory of 5020	2084	msedge.exe	83
PID 2084 wrote to memory of 5020	2084	msedge.exe	83
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 4528	2084	msedge.exe	86
PID 2084 wrote to memory of 4528	2084	msedge.exe	86
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 732	2084	msedge.exe	85
PID 2084 wrote to memory of 5892	2084	msedge.exe	87
PID 2084 wrote to memory of 5892	2084	msedge.exe	87
PID 2084 wrote to memory of 5892	2084	msedge.exe	87
PID 2084 wrote to memory of 5892	2084	msedge.exe	87
PID 2084 wrote to memory of 5892	2084	msedge.exe	87

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.Smo.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.Smo.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.Smo.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff8665ef208,0x7ff8665ef214,0x7ff8665ef220
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2200,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1728,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2568,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3372,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3396,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5016,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:2116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5700,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5996,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6172,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=872,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,16577698235228418335,8884588593429876360,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
34d09b852bf4a5ef1d936591501926ca

SHA1
88ff0b1c2a5664765e11e47843a5ac8e1782ed0c

SHA256
52bd897dfdfca849d627b36a49b976eef861b1a7af075527c8f247adb862dc20

SHA512
dc63eebf94384dc9580f5e3c9291047e8d410f8fc1f746d180673f445a9bbe746608c01cbf10a38f2f935cfa5c8bb89864f87cabd8fece809dcaa1fa137f71d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e2d59cf9d648f6798eaac1b2d629d709

SHA1
93bdd22e823691bb88fd7e0f6f5524c070babd48

SHA256
4a8b605989b08d0a4a68f25bdf1677b6ef89958582a0d46a6111cdba1740b938

SHA512
079186884cec284f1bce73e8132cf9521575db639bb127ba85ae179604ccd57fb616e3102b4ad796817da7ebedee4c268d1c5808373708d90c70bc16b93e2135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e43d2966a46af8af0706e3c69c20e97b

SHA1
178ed2ef506767aa072128fcbe41f30b2bc93576

SHA256
3c50242fb96ad4f5cd906e16d655bae53821768fc79bbe1e862741b69f7311ba

SHA512
2c3f55e0c455ba540c97fc1128abc753dbe3e71287f1354927c4abc02b7641f0586a78f90ff5794f46d95506b914214f27e7a29d27ea30382ef60e56c2a33c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
3c7dfb832be9e5450681cf00b5782d35

SHA1
6758669cb928e6297c72386e22b4e8cfc158364e

SHA256
42c3f50ecaa030ddd2d38b518c477a8d01737d75f2b22cc466eced1b8372df16

SHA512
b672a6acc83758456c2a828668f75d8e23319dd116f72fc2fb3451701394606d5843075b7fecf19f18275e29612747e3f2c6a32d422d1fb45af7d418dcfc5254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
ddbbfa6805ccbf2384b72ac402664f61

SHA1
17768c81d1e20e619c3f9e33dce31c5ab1adf449

SHA256
bfe5a62275410cdac075ef1127d8f9f24b3abcec7f9d9592fad2fdaece11697e

SHA512
fdbfc12105ac0a115f60cf902be4051bd8b76519b1d96cbbda8e6568486afcc669186b91bcef69e8ef8901e166002e755a1cfb11efb147fbd7dc24c6634a19fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
e59c736efa96c76063886f033c2e89a6

SHA1
0131d911bc77478e2936ba535ea7bb17f4044792

SHA256
664eb7bb831429a6c548cc363659ccc69cfea642332dae99f6df9acfa6294736

SHA512
f26f82e7da88818bd7290ba4f7a1805c472df0240ec2f6a571417831ef49da2ed886e981cea198a8de210fdbe6700b2b85ccd3a3025e1dc991590e8348e9cd5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
a1951d7f7e79c5eba17177b506ec9445

SHA1
d07af3d48f17bcf2b9bcbe18b3fb345103e4eba1

SHA256
3f0eee479b44f64bdfacd25332cc5796d06d95010ccb2b67e2513e2b6f9f2e2f

SHA512
53f6222042ae77cd09894aa620c80b1efce89ca285ddd277aea76bf44c56b2355bf9fd65f348363040db08d9b1d2ceb2c2735cd1e2491b1f0268cc001895325b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
75164385b11390b75021238df4b5c45d

SHA1
8d273309d5a4196165a98dc1952c63febe69f2ef

SHA256
647d5e489feff0ac7aff0f99de93d2387fab69583ec6bf14ab6bd1e0a6fed5db

SHA512
5ddfb274333432932a1e19f3d9d928ac01e71be65559a22fc8184a8dd07f56eb3a806bc3d3e2a84863fa642277886c41ce781a5de03d3deb92cb7fe02b2f1260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
3883181c600d1d02a244f8bec4d077c1

SHA1
a408af62cee960e287f2d21bebb8b4288ba1dbcd

SHA256
8faa4927b762f21e8eb9989719ef2ada1a5c086f042d85a03a4870b5772f3f1b

SHA512
94b3eb856f9813166b718bfd0bacc6ccc452155890dcace60378216b7b3469bd7b4b4df79d233ce100c34070a644438e9c5761ad224502aa41839f6352ee05c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
a99735a57fa074d361e47d325044f980

SHA1
13dd925fe2751941a456ccccc494b51c2898ad3b

SHA256
e7df3ea2be2f093e057f195d875c36ffae7b90856198dc3c8211a7c7cbce6156

SHA512
406ebbecf78478beab851d7fab5e10a9b9d58d6bcfb5ab31c812e62107213f05185cdeebef99fa645af5a4a27513bbec2633ee576b6353f421effa3a2f818428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
db7549dbfc38d060263ca5a2f2e85b80

SHA1
2fb84966295ac120ea5ed0a5d9cbd0a7c154988b

SHA256
ecac2669ead6b97f2edcdd298ecf9cda6d5b389d60a61f3bc8c90b615c11e9cc

SHA512
58376aa4ee7a70d973bacdda665c812a393b34636838c36926a8f3f014420d860b0cce01e3501a2723a4a37ca9368a93ecba4c42573d9361bbf13f3ab59693c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
6d3768e90655969a70386e93ee23af89

SHA1
831f149e1fe9b71066d18f2a53bf207c5d634c7e

SHA256
0c3cf26415163feac64a3e1a1425b2f2b00b509f505e047577cf75982f54a0ea

SHA512
b658dee1a7b808201935f838634bf100d19e5649d303e603d195e3ada05164b8e9dc1dc33975910fbf6ba489c67276bf6915254660e120bd0aa7bf4a9e389856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
34a7ea361461b9ec12b2ca05f4ff7bf6

SHA1
2bfc523a6e090ff3cf082b2ffc014a61189a3ad9

SHA256
21ef90c551ceeeb6a7bc711b3de233c5ccd245d7868db9bfb36a4e0a15f0f771

SHA512
19b3e2824f4b5a556983637fc02cf1ed89da51146df415626c35115a8fb2acfc5a3372c6774c5f0d1cfad017cc9520c8e1aacd04d65fd573b7b6004794801778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
8121f6795b111ed48bb92ae142a704b6

SHA1
120ff85a3b97973c3cf6ae7d8e215088eb8ea583

SHA256
2bb0712431bfba835170bfcfb95a60d49ab34f2c312ae05fb7a876fe08bdff6c

SHA512
c95900d601ef978486386e3ba78c195f67277a3e1d5d5bbfcf5afb7a367e2682cff5a5bec88ba16667ef141c9459b8c2edb45470d8d9c95b8cb6a4041619ba94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
a1d7c738c6f07fdd290874daebab4e84

SHA1
d3048896f5bbba796ed8a69ef772ae8b49e97093

SHA256
a430d2b221216ee40ff46ea4e5ecd096eb4e0508aa90a2f966b8bbb2cdfe4fbb

SHA512
3fe028c77f97d9fa3dc13c811f442c7ddb2640e20f5afa665aa56f01cb4406c88df823241a02f631a67550b14fca61e0e70c05ae1c8c2827b2606321bf27d89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5ac5d9103bc36fd30e6690de2c7365b8

SHA1
cb9e2b287dc17baab6640e567e23b83df3e9c4d7

SHA256
a2df85088c91d4b7bd62d56eaa3984a26db50986fc2fa62db3eaa3d6e99ec897

SHA512
7d8f25ddbeec43409b064a5229cdaacc2930fd7e386a2ee7c24d8ef84b3f0230da091bb545800d0debd19e2552ab84adbbd5722f01ef38fd983e8e4e05ff2297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb

Filesize
623KB

MD5
b5467605f1d5600fe6d540ebbad3c3a7

SHA1
4c52cfde3375a6fee3c1bafc6deecf77015ab154

SHA256
f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1

SHA512
0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1218697479\manifest.json

Filesize
118B

MD5
03e6b705075692ba847a04282c612238

SHA1
c49e349819bc7d2ce591fbae49377d11baebc943

SHA256
afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a

SHA512
28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1843584283\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1957287188\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2084_1957287188\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
memory/5968-17-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-8-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-15-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-13-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-12-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-11-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-16-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-10-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-9-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-22-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-7-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-14-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-6-0x00007FF888E60000-0x00007FF889069000-memory.dmp

Filesize
2.0MB

Download
memory/5968-3-0x00007FF888F03000-0x00007FF888F04000-memory.dmp

Filesize
4KB

Download
memory/5968-0-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-5-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-20-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-1-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-18-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-19-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-4-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-21-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download
memory/5968-2-0x00007FF848EF0000-0x00007FF848F00000-memory.dmp

Filesize
64KB

Download