39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
146s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.SqlWmiManagement.xml
Size

104KB
MD5

3160c8e820e8c8c02b2575b9246a01af
SHA1

4c3ab24812814aafd24ae3243d730c4b42716fb9
SHA256

60cbfcb1f4c55b80e8c7a6bc249380e918dcd1ae5c8f92ce5807b3661bc95ee0
SHA512

d9c9a99ccb67e845a85b0330eff98314e9ba029ac115cf906fb275314af872964df1891e9dcd8ff98bcac8985a95177afce762b9e9c0211a31db9a9263bbfb3b
SSDEEP

384:pnXBXHpPELWEi/9H/97Va8SZNIYURQ0c0LJBvKGwAtuEY158oo1YTI5vzzdY7l/2:lJlzoav53uh9BsP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1894273065\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1894273065\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_697908342\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1750507201\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1750507201\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1739167629\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1750507201\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1750507201\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1739167629\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_697908342\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1894273065\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1750507201\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1739167629\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1739167629\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1739167629\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_697908342\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175343"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3164951566"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897014072653637"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437575798-4173230203-4015467660-1000\{ED1CEF90-2D17-4A8C-88E2-A75F19B646B5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 6028	2236	MSOXMLED.EXE	78
PID 2236 wrote to memory of 6028	2236	MSOXMLED.EXE	78
PID 6028 wrote to memory of 5652	6028	iexplore.exe	81
PID 6028 wrote to memory of 5652	6028	iexplore.exe	81
PID 5652 wrote to memory of 6128	5652	msedge.exe	82
PID 5652 wrote to memory of 6128	5652	msedge.exe	82
PID 5652 wrote to memory of 4272	5652	msedge.exe	83
PID 5652 wrote to memory of 4272	5652	msedge.exe	83
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5024	5652	msedge.exe	84
PID 5652 wrote to memory of 5032	5652	msedge.exe	85
PID 5652 wrote to memory of 5032	5652	msedge.exe	85
PID 5652 wrote to memory of 5032	5652	msedge.exe	85
PID 5652 wrote to memory of 5032	5652	msedge.exe	85
PID 5652 wrote to memory of 5032	5652	msedge.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.SqlWmiManagement.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.SqlWmiManagement.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.SqlWmiManagement.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x350,0x7fffcedbf208,0x7fffcedbf214,0x7fffcedbf220
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2720,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2168,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3428,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3516,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4852,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4840,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5344,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5436,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5436,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5420,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5056,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5148,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=880,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4776,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5068,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4904,i,13914543869880634358,9947940812904561927,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
27d02a9170feb143c10bced3f0c7ad50

SHA1
0e807524dd428900bf3c6b91190740adb8e7e660

SHA256
f7b57a37dd1bf12371382fb12cd8f0ebb8cbc86323a10903d62014195e3142dc

SHA512
80723887c4cd5aa3847d68d3bbbfbaa29e1858ee08bfa2c51369c31e44eee1b627a2ae8cb1f2a5ce75a5a91d7ddfe4ce8f3dcc5da818e4f2dcbc2f746bbe9589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9200379a94ab02f9b6b882936b6bebd0

SHA1
08f5bcfe74ca065a21c22959388d350193b27004

SHA256
95c71851890080a2266ecd78522c75dfb217e0cb45661f6efc2e8fa601d0f651

SHA512
02a46ed77856ffe468f4e808c494f937a88244d4a434b9c8bba992895fa2b73d8ce218874fe5d1cc25c6781ec492046ec55bc33cd71d648e21ccf5f716a7de0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
73f4c4304aad5a2a0a211b7823d55741

SHA1
8e36a6a4cce7b8ebbc7bea92e1e90aaef0c46bd2

SHA256
c5c1c05bc6638eb7d3b0f4ba117d735224ed07cd2b7dd8dfafcc6fa1de844a5e

SHA512
fb18631cbbe82d6a2d45e08e7edf51a9d512bdeb73b44b8dbd57be906d3139804e003bcc830586341e201cdfdfc3d93c39a7aba9282564e0350d95b2e270dc53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
42e394dddbe9ebd4ba3e8bf12e334f39

SHA1
639509c4cdef797201582af3c46cb01c6e305b5e

SHA256
e6fa0d52e42cddd56bf154fd1d7bb6a08e1f35af4a6bb7023b52f062588f893b

SHA512
449a2f322a2fd8164101e61a4d7cfb83fb1cc1d2f9193a0f455f6f557fbe647b11f8cf70e9d80bed6239db8c9c71bce02e863b5dfa0657d7832a5369190dbba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
6d4dc31f45940e5b8044ec35383a5b1b

SHA1
c9a74e46c69d3f2ca7d38da28f6789a4c407a575

SHA256
7e75224ce1aac2bf277387a6761ae910458641d07b4cf0fef43b3bf57b0afb9e

SHA512
2fb7a69d7c79ce3f67fd923f7d8979eec13dc9debc95158660c125fd277cdcded1ef7f966b65e1d4ccd51ddeb25b1eae03f46e4e26a2d95a5388df75302ea156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
974428b7ec16dd0dc63aa63e19247b05

SHA1
fca218649a63962aa5034a9d120e7cc8233c5392

SHA256
bed4548e0710f314595be1b0a890aa023d8f7665f4de6167baeb47e9bd37b054

SHA512
c2a9da211d7fdcc5a491e2cd46c69bfa9809d3c507798de463cb419314fdbc3c1c2e8fb8e3b2a400d87f4890f1d9b978b72c6e26723dc12f89bf87b144dc1186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
8f94056dc51861d6ce47eb9b9441fa6f

SHA1
4c25b203a270901284014338841ede3ff2c1ce21

SHA256
9dc0245c2adf787de1596d28c59c6f63a64f8c662825cc562e82dfdf217aaaa6

SHA512
c66ce9d1c447904a3527c46e51d50d2212336281365380ca6030ce4abd01b10a402738414b286a12388adb463517dd687ee8ef3142278338b1932c3f5752387a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
9a032f00eb34b167b3324fbd9521f99e

SHA1
36b2040dee810c6e89df2d74028a17e216dd0096

SHA256
f697369fc32bbb3edc9be6cf11cd2cc224160fc324f80354e3b0c542abf58e18

SHA512
57b8fc7a1f24f077f20d48877daed25f4d370f20ffa90c970d9c7276827c6c1b258343b18cc4a99d1e04841fdcc20012fc59de0062851d777e312f638ada2dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
1acbe932de9cc915e0828fb8fdac9269

SHA1
7dbe429af02c07f07e8179b65e63d58a790148b9

SHA256
388d1f12b9c04432436d8cd7ba5274d75c7dbfdb91fc4880f78e1768d482e579

SHA512
235b1e265c9540c40bc03fe26ce5c5c8f553708543220903daf2f9cbff7d053ce2c8422c7d22ad91e5b11bb7aba75e0bbe4d1655881f22ea57f2ec3ed195976a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
314aab5dea05a6c5953f68c761a4f23e

SHA1
02ff661157bd601fda3d91041ebfe74e4119f11b

SHA256
c06a721c2223aa4da37bd2fc0a647e14ddbac24566f1ea6f41258536beee2110

SHA512
e0132459775c75d286614e780e6fa70db03647c792b9819d491601db0cf630d75cf3d4ed84cefe3994a581abd2119d82b0355a2d4034048172c69c5c303899ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ad27114461b7723a135f07ed23cd34c0

SHA1
24d1127e2352f388e7b7ceb0ce4fb8e99fb66560

SHA256
0fa32cdcac15aab729d000758e691140db202b1bd35f43aaa6f8ee35f8987629

SHA512
c357fb839ba221ead72b3c1074aa903295d8c9a78b165e0226184bbf4fb0d4004ef3229e162445c8e4e0593c7c65f6967a4abbaebf520c6605f8a41bd3867161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
4501b8d65b6d8b853bbfefd0f1b5e2a1

SHA1
b612c398abc0f08efaf5aee17b3efc0a5f07caa5

SHA256
6aeb4d8eef2269900e930c6b8c0b9aaa575507d962155bb1ac5751aad966c3c2

SHA512
fd62a6a1686761d171f76a471b89d73b359db1da6fc42c9e45f6e4b04f4f68665f92e073aa91af723a2c56e490909e53d24c33b7392c0ecc10d1b0a5058571b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
1ca20e678e81acb5abd64676b5bc5dcb

SHA1
d8f9cf2f4a55500032dc7bdadfd71c9d38566bb5

SHA256
6eff128ae2438b673ba0e35436ec1bb427425f30e04bd8a3e6f9e21890547eac

SHA512
ca05f42b8351a1c6bf0fd2faf537caef68aaa12acc9f196915d8573aef0e253281d6736b1023f07c365c2173c9b4c7581b4422933fd97a49dd2040908644b454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb

Filesize
623KB

MD5
b5467605f1d5600fe6d540ebbad3c3a7

SHA1
4c52cfde3375a6fee3c1bafc6deecf77015ab154

SHA256
f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1

SHA512
0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1739167629\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1750507201\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1750507201\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1894273065\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_697908342\manifest.json

Filesize
118B

MD5
03e6b705075692ba847a04282c612238

SHA1
c49e349819bc7d2ce591fbae49377d11baebc943

SHA256
afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a

SHA512
28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04

Download Submit
memory/2236-7-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-18-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-5-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-6-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-9-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-19-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-17-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-8-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-0-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-10-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-2-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-3-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-4-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-16-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-12-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-13-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-11-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download
memory/2236-15-0x00007FFFA2310000-0x00007FFFA2320000-memory.dmp

Filesize
64KB

Download
memory/2236-1-0x00007FFFE2323000-0x00007FFFE2324000-memory.dmp

Filesize
4KB

Download
memory/2236-14-0x00007FFFE2280000-0x00007FFFE2489000-memory.dmp

Filesize
2.0MB

Download