Overview

overview

10

Static

static

3

SecuriteIn...51.exe

windows10-2004-x64

10

SecuriteIn...51.exe

windows11-21h2-x64

10

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 07:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe
  • Size 1.1MB
  • Sample260415-jgqehsby81
  • SHA256 754016da93b35b51d4abbbcec0bf4ff6e9670109a2b5ecbdbe04f010a7843539
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectiondiscoverydownloaderguloaderspywarestealer

Malware Config

Signatures

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
    collection
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe"
      2⤵
        PID:4704
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe"
        2⤵
        • Drops startup file
        • Accesses Microsoft Outlook profiles
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:3408
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651.exe"
          3⤵
            PID:3644
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte"
            3⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:880
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa7f7cc728,0x7ffa7f7cc734,0x7ffa7f7cc740
              4⤵
                PID:624
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1664,i,9672304425336349059,2732801645812855890,262144 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:2
                4⤵
                  PID:1320
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,8349450920780330325,11102836202714245001,524288 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
                  4⤵
                  • System Time Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2552
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,9881739014708874721,1373843585193987044,524288 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:8
                  4⤵
                    PID:5132
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,15513997082572885841,5871750065388707052,2097152 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
                    4⤵
                      PID:5296
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2956,i,5707485418100071802,12947162293340682791,2097152 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
                      4⤵
                        PID:2740
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3324,i,1601797237524643387,17834411329051694454,2097152 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
                        4⤵
                          PID:4772
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3352,i,10853865230389742974,16892325018055797686,2097152 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:2
                          4⤵
                            PID:3892
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3856,i,12794737590258856343,3750351257179903285,2097152 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:2
                            4⤵
                              PID:4328
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4156,i,1033209714970784613,4313332992638650976,2097152 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
                              4⤵
                                PID:4080
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte" --force-high-res-timeticks=disabled --metrics-shmem-handle=4212,i,5933904120720058514,9228191295766524718,524288 --field-trial-handle=1972,i,16095351637699875154,6818089311298554111,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:8
                                4⤵
                                  PID:1484
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu"
                                3⤵
                                • Enumerates system info in registry
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of WriteProcessMemory
                                PID:1416
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x248,0x7ffa7f7ac188,0x7ffa7f7ac194,0x7ffa7f7ac1a0
                                  4⤵
                                    PID:5276
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1732,i,6520987862412828395,3270239929625460180,262144 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
                                    4⤵
                                      PID:4864
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,3293893393096195016,17408395405717160206,524288 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
                                      4⤵
                                      • System Time Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1088
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,8457507765987529055,4159862974345489374,524288 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
                                      4⤵
                                        PID:5848
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3068,i,3894694241323658819,13796903410302210899,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
                                        4⤵
                                          PID:4604
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3076,i,8510782288197929584,10526926514178121217,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
                                          4⤵
                                            PID:4600
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3504,i,4466298068930366131,1180597555155131488,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
                                            4⤵
                                              PID:2444
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3588,i,2400624322260358517,7672045116540661248,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:2
                                              4⤵
                                                PID:5824
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3600,i,4571449759481258295,7306644136538702757,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
                                                4⤵
                                                  PID:5956
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3624,i,10058070678225057140,17050875462072049071,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:2
                                                  4⤵
                                                    PID:3436
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3636,i,5384436946241068040,14975417999629643911,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
                                                    4⤵
                                                      PID:3868
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3752,i,9581459076979773432,7187299189174524573,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:2
                                                      4⤵
                                                        PID:5424
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3768,i,11837869154236373109,17877477649741176063,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
                                                        4⤵
                                                          PID:4180
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3820,i,17365511508727939587,13010263369232727244,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:2
                                                          4⤵
                                                            PID:5012
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3852,i,6824252410541727692,3827069392335230364,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
                                                            4⤵
                                                              PID:5372
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3876,i,11686678462732702990,9920272001023062379,2097152 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:2
                                                              4⤵
                                                                PID:564
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,14757237761778412688,15261799825600726321,524288 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
                                                                4⤵
                                                                  PID:1368
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,17224678681459931501,7152692119785209224,524288 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
                                                                  4⤵
                                                                    PID:5868
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,12856814482495990991,12267877546925374769,524288 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
                                                                    4⤵
                                                                      PID:4708
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,7823601323719486850,1739499579067878312,524288 --field-trial-handle=2204,i,14581394138752171997,4252743630589411016,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
                                                                      4⤵
                                                                        PID:2580
                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                  1⤵
                                                                    PID:2268
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                    1⤵
                                                                      PID:3332

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v16

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          settings.dat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Crashpad\settings.dat
                                                                          • Size 40B
                                                                          • SHA256 3e36e6bead0d9dc060253cf2e1f2dd1231602a73e4c1be115fd9dc7c3d2afc8f
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          data_0
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Cache\Cache_Data\data_0
                                                                          • Size 44KB
                                                                          • SHA256 91a450607ab25668f59d13c70f5559933978f7bef96d47eafbf7e2348977ebae
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          data_1
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Cache\Cache_Data\data_1
                                                                          • Size 264KB
                                                                          • SHA256 e81570a9b6845f77eac8373f2965d38601ba927d5eaf9a6fd69e9ba9b3a94ca0
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          data_2
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Cache\Cache_Data\data_2
                                                                          • Size 1.0MB
                                                                          • SHA256 51d09fbd9354cf1e25d2b0846e25cbcfe73ab6ff5b12f954776fb6f44f1190ec
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          data_3
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Cache\Cache_Data\data_3
                                                                          • Size 4.0MB
                                                                          • SHA256 aeffc4d5855d9b296cb16b013ce1d78f39ed50231eb495a205f7653a0a47efbe
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_000001
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Cache\Cache_Data\f_000001
                                                                          • Size 35KB
                                                                          • SHA256 9376ec0bba1143d25a3c3c8f3d40c8c11327f6e8b485d9cea9e427400ddfd217
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_000002
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Cache\Cache_Data\f_000002
                                                                          • Size 65KB
                                                                          • SHA256 7bc424130eda2bae7fca759b777f9af68b2ffdd1db9799c7f5b482bbf3375a2f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          index
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Cache\Cache_Data\index
                                                                          • Size 256KB
                                                                          • SHA256 cfc7eae54cbedf4817500419ac3a5c5c24da93dbc42bef6421ae5333aa23b7a2
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ba678a2fbd8c358c_0
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Code Cache\js\ba678a2fbd8c358c_0
                                                                          • Size 298B
                                                                          • SHA256 627109f1b9d11d8dc673dda3d665a417af4083d7b401b0007a466031f2b2aa59
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Code Cache\wasm\index
                                                                          • Size 24B
                                                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Code Cache\wasm\index-dir\the-real-index
                                                                          • Size 48B
                                                                          • SHA256 32703f51c5e0826018eae1bfc559ab4c23401f048bb715419faca783f7b759d4
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          index
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\DawnGraphiteCache\index
                                                                          • Size 256KB
                                                                          • SHA256 6ceb8410fb5596aded60cb5bf8310106d06774e1ddb6e13756b0ccbf049e2b82
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          LOG
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Extension Rules\LOG
                                                                          • Size 265B
                                                                          • SHA256 fdf771a92d5e6c7f5998bad0c69c628653e3e57a450f3ad9963cfa950aa68218
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          MANIFEST-000001
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Extension Rules\MANIFEST-000001
                                                                          • Size 41B
                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          000003.log
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Extension Scripts\000003.log
                                                                          • Size 76B
                                                                          • SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          LOG
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Extension Scripts\LOG
                                                                          • Size 269B
                                                                          • SHA256 f933e601b8b52eae3d22d2ce226de8acdb2eefe38ed0caab6c93401117121b0b
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          000003.log
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Extension State\000003.log
                                                                          • Size 228B
                                                                          • SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          LOG
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Extension State\LOG
                                                                          • Size 267B
                                                                          • SHA256 417911132ed494e6c0cb877ec11ead2dce4b0706f805a3bbf75d20455fa16070
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Favicons
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Favicons
                                                                          • Size 20KB
                                                                          • SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          index
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\GPUCache\index
                                                                          • Size 256KB
                                                                          • SHA256 46e1304a504aebee77f4d4a684fc25d1d373caa7d32d82703a1415443bc0b6fc
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          History
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\History
                                                                          • Size 160KB
                                                                          • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          LOG
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Local Storage\leveldb\LOG
                                                                          • Size 277B
                                                                          • SHA256 f1dff8a311da2e72f4ecfe93643fd35d3e7996bda1f2104bb85690ef30f3c68e
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Login Data For Account
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Login Data For Account
                                                                          • Size 40KB
                                                                          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Cookies
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Network\Cookies
                                                                          • Size 20KB
                                                                          • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          SCT Auditing Pending Reports
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Network\SCT Auditing Pending Reports
                                                                          • Size 2B
                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          CURRENT
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\Default\Site Characteristics Database\CURRENT
                                                                          • Size 16B
                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          data_0
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\GrShaderCache\data_0
                                                                          • Size 8KB
                                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          data_1
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\GrShaderCache\data_1
                                                                          • Size 264KB
                                                                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          data_2
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\GrShaderCache\data_2
                                                                          • Size 8KB
                                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          data_3
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2ffughcp.qte\GrShaderCache\data_3
                                                                          • Size 8KB
                                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          System.dll
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nsg898.tmp\System.dll
                                                                          • Size 12KB
                                                                          • SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          settings.dat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu\Crashpad\settings.dat
                                                                          • Size 280B
                                                                          • SHA256 bb272e489bad2dda03541a92827a5e551fe27310bbf34b0b77913c2da897574a
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu\Local State
                                                                          • Size 4KB
                                                                          • SHA256 2e1de39ae4e49b55237c0efc8857037cbad3a2ceb3683d9a423d330e98f46ed4
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu\Local State
                                                                          • Size 5KB
                                                                          • SHA256 b3f6734169769c003fb2035b6721d4bcde7297944afd16e499c2b3d374899d1f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State~RFe586174.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\x5nnb3gf.yhu\Local State~RFe586174.TMP
                                                                          • Size 1KB
                                                                          • SHA256 63f8e7f5cd20098734204073da372b4510ec66177143fb4b484a7c83e53d52a9
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          memory/1088-495-0x000001B71D800000-0x000001B71D96A000-memory.dmp
                                                                          Download

                                                                          memory/2552-207-0x000001A41BCC0000-0x000001A41BE2A000-memory.dmp
                                                                          Download

                                                                          memory/3408-66-0x0000000037CC0000-0x0000000038264000-memory.dmp
                                                                          Download

                                                                          memory/3408-68-0x0000000037C50000-0x0000000037CA0000-memory.dmp
                                                                          Download

                                                                          memory/3408-59-0x0000000036720000-0x0000000036778000-memory.dmp
                                                                          Download

                                                                          memory/3408-60-0x00000000368F0000-0x00000000369BA000-memory.dmp
                                                                          Download

                                                                          memory/3408-61-0x00000000375D0000-0x000000003773A000-memory.dmp
                                                                          Download

                                                                          memory/3408-57-0x0000000000450000-0x00000000016A4000-memory.dmp
                                                                          Download

                                                                          memory/3408-572-0x0000000003E00000-0x0000000003E5F000-memory.dmp
                                                                          Download

                                                                          memory/3408-568-0x0000000038B60000-0x0000000038B7E000-memory.dmp
                                                                          Download

                                                                          memory/3408-567-0x0000000038BA0000-0x0000000038C16000-memory.dmp
                                                                          Download

                                                                          memory/3408-566-0x0000000038770000-0x0000000038782000-memory.dmp
                                                                          Download

                                                                          memory/3408-62-0x0000000037970000-0x00000000379D6000-memory.dmp
                                                                          Download

                                                                          memory/3408-64-0x0000000003E00000-0x0000000003E5F000-memory.dmp
                                                                          Download

                                                                          memory/3408-65-0x00000000016B0000-0x00000000039BA000-memory.dmp
                                                                          Download

                                                                          memory/3408-58-0x0000000000450000-0x00000000004BE000-memory.dmp
                                                                          Download

                                                                          memory/3408-67-0x0000000037B20000-0x0000000037BB2000-memory.dmp
                                                                          Download

                                                                          memory/4464-39-0x0000000004F20000-0x000000000722A000-memory.dmp
                                                                          Download

                                                                          memory/4464-40-0x0000000074175000-0x0000000074176000-memory.dmp
                                                                          Download

                                                                          memory/4464-41-0x00000000005E0000-0x000000000063F000-memory.dmp
                                                                          Download

                                                                          memory/4464-42-0x0000000004F20000-0x000000000722A000-memory.dmp
                                                                          Download