39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
145s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.SmoExtended.xml
Size

208KB
MD5

f03a2a39380b39cf235fade7b7305c4e
SHA1

86c3e7ea00eaaf4de3076d78c4d27d4c4494a969
SHA256

6e8f9b8400a81cc79e5d530de91f7924f3940340c3de6def754b193bd1ef7c0c
SHA512

a30bc6140c67c4469c6c926c4c8e5306574bc3550d33bfbbe6830210dd0758104d21523336de353d5c48cbc8d3ead30776e1ec1731c0eca35f0102f08bb93d02
SSDEEP

6144:cJPLLJjbMucFyXTa2UveT8T0h831CxhpgsEMprsVLr/vDN3T8Ts:cJPLLJjbMucFyXTa2UveT8T0h831Cxhy

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4984	msedge.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_253110383\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_253110383\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_99436454\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1032689249\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1032689249\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1032689249\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1770489726\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_99436454\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_253110383\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1032689249\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1770489726\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_99436454\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_253110383\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_253110383\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1032689249\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1770489726\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "111437730"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897013978003203"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3582532709-2637047242-3508314386-1000\{6DA8042C-9357-4A6B-8743-91FEBACA59DF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4852	4420	MSOXMLED.EXE	83
PID 4420 wrote to memory of 4852	4420	MSOXMLED.EXE	83
PID 4852 wrote to memory of 4984	4852	iexplore.exe	86
PID 4852 wrote to memory of 4984	4852	iexplore.exe	86
PID 4984 wrote to memory of 5944	4984	msedge.exe	87
PID 4984 wrote to memory of 5944	4984	msedge.exe	87
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 2304	4984	msedge.exe	88
PID 4984 wrote to memory of 4440	4984	msedge.exe	89
PID 4984 wrote to memory of 4440	4984	msedge.exe	89
PID 4984 wrote to memory of 3668	4984	msedge.exe	90
PID 4984 wrote to memory of 3668	4984	msedge.exe	90
PID 4984 wrote to memory of 3668	4984	msedge.exe	90
PID 4984 wrote to memory of 3668	4984	msedge.exe	90
PID 4984 wrote to memory of 3668	4984	msedge.exe	90

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.SmoExtended.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.SmoExtended.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.SmoExtended.xml"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffb2f76f208,0x7ffb2f76f214,0x7ffb2f76f220
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1956,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2180,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1892,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3384,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3392,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4828,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5400,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:2300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5572,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5572,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5760,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5664,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2916,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5832,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3964,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,13564076916411369872,7962572696344444434,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
      4⤵
      PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
978d790ea9bbd3b3113b1d32773304fa

SHA1
61c9b3724e684c2a0507d7c9ae294e668e6c6e58

SHA256
36c686a276e904607d2a18c2a2fc54467fb8dc1698607f5d5a6cefb75aa513c8

SHA512
d50740255d20d2a5e6abdc78f4fe9ef6e832f2ffe9ecc200916a73db1e0dd37d67d88996b315e128bf5b77bb110e4e8c29905aa5d90b83019be2cc8127d0dfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
717b37d005b78967b23cbafb9f440f1b

SHA1
74e24c717e23e492de4bb111b6645863e406b56c

SHA256
38dbe9053c99810496ecda32f87a430ed0192f2852ca1af20cbc52a83e05402d

SHA512
7f396c6e8e9a21fe0cae95999c4fd3bbcf3e38a9b13c01d43a29f0adf57ace93c68538565fbc90d286c855d7eac0362ac5f8b366a3a1b051366711aa714badfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
ecf5dda0d3b438182dfa62456a250ec4

SHA1
07e152240fbbbb62c4658390eb8d1f8af4ede2cb

SHA256
ca43dc03cd925c2af1f6b17c1bfca8a84ddc3deda2103ebfe2698d47ad196ed1

SHA512
42e364a3e901d4064d1d3ed8fd00ae35019bbb4bc0625ea9f5141e52a54330eed96c6aafe6be428fc79000855d90c322afd32fd8ed4d7d2eb0a0ec6d0ee945b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
bb6612f42746aa8b3070ed7a6a704e37

SHA1
a6ee579d50d56937f527e0c85e094d581482ebef

SHA256
d1d66e4c3692732b0c71182a348e7f851cdd73901fa959a3e898bb376763e6d8

SHA512
ed2955ce2bfa298cabde967f7acb1ea4d213b6586b2ef0949b86c37d229119d9a22982c30e16571ac1e6f5c55018a83830718daf9432cb35c79cdb316c53e794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
b109f89fe9492ac3f76016ecada15080

SHA1
b30ff47f6a061f8971c57afda9bedd9c507842aa

SHA256
dcfd0b5deeacd40fba343f6720d41e60cdb37671c7a12b71a7ee385b92cefb51

SHA512
22128cb16c08a9353abfa09d93873ee3572f891ce870633f84e61a06aac9968e8d1bab0c439aa113bcdb2e8951c494c9e0041862881c7af404e1a2a15f922bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d15b02f1a3e6e130d96085c6654123c1

SHA1
6eddea004eec1d813bb3f534ec556a37e50ef5fd

SHA256
36e1d393982f9ae550b6782b2ac63eebf7207a3fde450405177914ba4f513f3a

SHA512
9782a82c90c42377ed0f1d749a837975e6523fecfaff43f19247ae31ce057648daa80f15591f26580693f847e2ac439496569064604bb2107c4a94a349966fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
acc447b8f36a3991836ff82166dd9bb0

SHA1
dd243e3a19b8fac0e4d071eba784ceebdd057e3a

SHA256
84675dd1dc74f7d25c5869f511d53a65460d0165e472b1c6f45a069d02f6b879

SHA512
244131fd4c0cc161adb06f413108ad3a0b60e3cebcad3b506afa2f3043b593c57390400c1f266754a56c8e400826422ce536c02cc3e268fb6948197f93e68e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
4021d850fb3e4d69f31a6234a46435f7

SHA1
b29afe23b7024b3c7f36fd9c99f2a9474d0671e0

SHA256
f219005b2c4ee0e7ffbfc41c3aef50cebc622c545552da08cba8c76b14db954d

SHA512
9a212bd34a85e6caf27ae48cf66f74f6f5cf3828de13272ca704bf60c0d3bc6b4415c6557b1dd13c69c95480baf0b89135ca69b94955e0fc4a54e57c6f54bc13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
232c6abe26d9d25fc88dc5a7f38d0003

SHA1
d8a33a03f86d96edb965f485df308861654f57f2

SHA256
c1790fc77e854bfee357ecb84efc7ac2b6cc32d531cfcd87973c6ebf58b58220

SHA512
4e92f0fbbc4421ed128429e617708aaa6cdd550806883a51cd33a75db770b0b3e6fac0808592eb05c9a280dd6d0e5d800d04b12b52521192ad44ce33f4228e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
075f05724fd5dfb25db53cb762c9e676

SHA1
2afe4e74771fa2ea68d453cd32f2ea41c1255b98

SHA256
7f9f5c6536ac1dca49aa90168b81c296ecad413f432611b19251e8c7a8b48807

SHA512
cc088846fb1f760f72e813e2c202cf1f64600770553016d559080bb45621f131b8ec5b68f0d77be9e0784ccf4a40eec5129fb426de5d901f5b9108d4ba455f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ddab3883314464de0888c5c4375f6433

SHA1
274055b3dd6afd411576b286877d0ed285d0c382

SHA256
66fbd31a1188ec8567640d06a4336c8ca6012259e46c863f9be8eea612503640

SHA512
02e24bda24d648547eed0eaa99769893575bc77c61f818a52cab0976353a1dccf2287acaef37291299db9e259bf0357b6bb578c3a076f1fc765dc0a8cb1b3fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f14dad2e1b12fe65fd1a92d1abc24eda

SHA1
d775b12eb64d46e37f02256baeef0b31fda3b4c2

SHA256
0fb155cbbbfa3a465c86c20fba24d0a828c01c365cdaa5fa4fec744584c7ed3b

SHA512
6564816446ba1d0c95db8bbe8cc2266c2fd97bfb4cfbfb4b6d08d8f66c096dcc89e72fb1497e0f8b77200745a93dd20c8d6aae6cb6f398b76cb98238a67c8a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
59df8c7c210dbba9c271264f0396f3a7

SHA1
ed642e9ccc71615db67ca5097c8a91b78a4d3d60

SHA256
fea51ad456104bc08983b95831d5f633812f2d9a418a072f6c7f4bca8091b114

SHA512
30a4bbfc136ff4e33e1d76c76b4e2973ffc830ab5cb83345fefc7ee655c41b952e67ef526a9d6ea7959913a986b62083c2e698cf7c832b71d8882cd6a92308c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb

Filesize
623KB

MD5
b5467605f1d5600fe6d540ebbad3c3a7

SHA1
4c52cfde3375a6fee3c1bafc6deecf77015ab154

SHA256
f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1

SHA512
0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1032689249\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1770489726\manifest.json

Filesize
118B

MD5
03e6b705075692ba847a04282c612238

SHA1
c49e349819bc7d2ce591fbae49377d11baebc943

SHA256
afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a

SHA512
28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_253110383\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_253110383\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_99436454\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
memory/4420-10-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-2-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-11-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-12-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-9-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-21-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-8-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-15-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-6-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-7-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-5-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-14-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-3-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-4-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-13-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-1-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-20-0x00007FFB523A0000-0x00007FFB525A9000-memory.dmp

Filesize
2.0MB

Download
memory/4420-16-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-17-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-0-0x00007FFB52443000-0x00007FFB52444000-memory.dmp

Filesize
4KB

Download
memory/4420-18-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download
memory/4420-19-0x00007FFB12430000-0x00007FFB12440000-memory.dmp

Filesize
64KB

Download