Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 06:02
General
- Target Agent_pr3m.exe
- Size 4.9MB
- Sample260506-grhrbae16m
- SHA256 e9b15558b11cb7bab202efeed7aad4cadd1bcbd1fa47c5f4b01d6cbc0ccd07af
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in Windows directory 7 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 22 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 17 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 50 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Agent_pr3m.exe"C:\Users\Admin\AppData\Local\Temp\Agent_pr3m.exe"1⤵
- Drops startup file
- Maps connected drives based on registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\explorer.exeexplorer.exe shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /K2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=0,02⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ff865fbc728,0x7ff865fbc734,0x7ff865fbc7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,13134634534258977053,13073931465354677981,262144 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2508 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,8092058703391917802,5669653387989722163,524288 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2732 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,15879264508769510528,12908502963531813281,524288 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2872 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,14410414454431380805,14476559283948073788,2097152 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3124 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,17559884141340420972,15176925052998342630,2097152 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3184 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,16751874335686995271,5363355881897803991,2097152 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4556,i,3629254016516905513,8418610459620169574,2097152 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3080 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,4224332117232204298,12702659731886399589,524288 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5380 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,11795525004098336523,17371414603538630479,524288 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=244 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,6266141688859266686,13879522175816975120,524288 --field-trial-handle=2700,i,8180636707222920274,16687549798372162691,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5456 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --window-position=0,02⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ff8622cc188,0x7ff8622cc194,0x7ff8622cc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1624,i,7217555103169129212,13999332082127518720,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1496,i,17309922722495070392,1232821600530896302,262144 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,11572642667650450441,9710594924215887035,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,12215673417902552145,13116955454970138554,2097152 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,7370153104415683395,16790002979258444854,2097152 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,1245928751503810947,16071687788997432300,2097152 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4120,i,5941210898297792326,17727673128214382967,2097152 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,420928805316345020,7861347230569657215,2097152 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4132,i,14098407707305671443,2084490627366858450,2097152 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,4533259299408743030,2169669037332429027,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,16418585348238398191,3469496428511616453,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,18048142433403447530,6662431881430384308,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,15829700295008732385,9010666411012365540,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:143⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11284⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,17822632545671179098,17324460279543226008,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:143⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=5924⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,8708849220725393989,2298969091305219952,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,8708849220725393989,2298969091305219952,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,3863263435880226042,11054128851770167140,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,16944373103547185710,11648636711230641809,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,943510460572997968,2659546446471680394,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,2023401888036347638,6348169244701775584,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,8245936402870712506,15279831255431538182,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,8094986257063274708,8147642639004819762,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,7823517681624685486,2317162136628092152,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,14284687854704210030,9386553508322227552,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14555835481106102043,15441422471483971566,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3156,i,17672326906335996598,15084826143280222055,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,16270053796240568194,6893691399245143160,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3435410336521748013,17471801489974230695,524288 --field-trial-handle=2304,i,12385533826852301564,9664348376580304495,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --window-position=0,02⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --window-position=0,02⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=0,02⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff865fbc728,0x7ff865fbc734,0x7ff865fbc7403⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=0,02⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xb8,0x120,0x7ff865fbc728,0x7ff865fbc734,0x7ff865fbc7403⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --window-position=0,02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --window-position=0,02⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
8e0eff10-46a2-443a-bf5c-091627f23c32.tmp
Affiliation Database
BookmarkMergedSurfaceOrdering
BrowsingTopicsSiteData
data_0
data_1
data_2
data_3
f_000002
f_000003
f_000004
index
the-real-index
the-real-index
000003.log
messages.json
computed_hashes.json
verified_contents.json
messages.json
computed_hashes.json
verified_contents.json
Favicons
CURRENT
MANIFEST-000001
index
History
Network Action Predictor
Cookies
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
TransportSecurity
Trust Tokens
Preferences
Preferences
PreferredApps
Safe Browsing Cookies
Secure Preferences
ServerCertificate
000003.log
LOG
LOG.old
the-real-index
the-real-index
db
Shortcuts
000003.log
LOG
LOG.old
index
index
data_0
data_1
data_2
data_3
000003.log
LOG
LOG.old
Top Sites
heavy_ad_intervention_opt_out.db
trusted_vault.pb
Last Version
Local State
Local State
Local State
Local State
Local State
index
Variations
metadata.json
ukm_db
Network Persistent State
protocols.json
BrowserMetrics-697C4EC7-1574.pma
BrowserMetrics-697C530D-AA4.pma
BrowserMetrics-697C6283-F68.pma
BrowserMetrics-697C628D-E40.pma
CrashpadMetrics-active.pma
settings.dat
settings.dat
throttle_store.dat
1a347da1-25d4-47e2-b6b9-1a0fec4c9e8f.tmp
LOG
LOG.old
data_0
data_1
data_2
data_3
f_000001
f_000002
f_000003
f_000004
f_000005
f_000006
f_000007
f_000008
f_000009
f_00000a
f_00000b
f_00000c
f_00000d
f_00000e
f_00000f
f_000010
f_000011
f_000012
f_000013
f_000014
f_000015
f_000016
f_000017
f_000018
f_000019
f_00001a
f_00001b
f_00001c
f_00001d
f_00001e
f_00001f
f_000020
f_000021
f_000022
f_000023
f_000024
f_000025
f_000026
f_000027
f_000028
f_000029
f_00002a
f_00002b
f_00002c
f_00002d
f_00002e
f_00002f
f_000030
f_000031
f_000032
f_000033
f_000034
f_000035
f_000036
f_000037
f_000038
f_000039
f_00003a
f_00003b
f_00003c
f_00003d
f_00003e
f_00003f
f_000040
f_000041
f_000042
f_000043
f_000044
f_000045
f_000046
f_000047
f_000048
f_000049
f_00004a
f_00004b
f_00004c
f_00004d
f_00004e
f_00004f
f_000050
f_000051
007a21ed5aec8547_0
034cae61f0d47807_0
040b9e1c62c4e878_0
04c1d06f6d9a8e62_0
0771870ec33cd3a2_0
094d5ee1c14f33b2_0
0a316d0394eb563d_0
0c017503814cc978_0
0e32b989d4969de8_0
0e7f7f7e3b490a8b_0
10b1a52c0747db76_0
10c1f883d388f9bb_0
10f6382a549e623b_0
12c939924e046051_0
12d6273c781a9e13_0
13a4b2ae4ee7dd85_0
13a8c5fcec46ae85_0
140563eabe527d57_0
146fdee792c7756b_0
164f335fee4a584a_0
16a2d7ecb9ddfc84_0
181469ca89670ec6_0
193a1c5db8cda960_0
1a695c7876b8ae18_0
1b39e49d438ad803_0
1c3d886e5aae61e7_0
1d2c57acca548911_0
1e66e5cebf418f6e_0
1e70ac4eff5c8a1b_0
1fcb61959f2be092_0
2069e833b08cc8b1_0
22a89772b218898b_0
245cba4a1f17a3ae_0
26ae73b45c131d09_0
27a07479a57b4bff_0
2903b21cbf3f9f84_0
2a8a6f695a3ff316_0
2db308382dbb7cf6_0
31a0b8404ddfe0e2_0
31c9465f16871e98_0
35c39844159a0f47_0
35df17cb616781a8_0
36299bdc676d44b4_0
3789bc98709e815c_0
391584aed568cc45_0
3e5da2f3caabc51c_0
4090768debc092bd_0
41b13e406d7682f0_0
426571252effaa11_0
47502480f8dab8aa_0
476cc8768b3efcb2_0
49ce869fc872fd10_0
4a02e8d6bffa6c14_0
4d53776d4a67f767_0
5123a0ca68c0fcf3_0
51392c339e962f26_0
51bc5bc7d2335685_0
5580c9141e68390e_0
55d42a6b619cf487_0
5d11642136f32e6e_0
5dedd9d2daa30072_0
5f283fd6404bf85c_0
5fea66044fcc0dea_0
642ec6d56d994ff7_0
66c155c62dd69a65_0
6a79a132df1066d0_0
6cc4e755e1690529_0
6eb509db088f39f8_0
7064f189fd052758_0
714969203a38dbc7_0
7192d197e6944bc9_0
7278d028fa3a4544_0
7574292b0f774bb9_0
75fc556fbf4087f6_0
78d8ca4435fb8315_0
7e66c8b9291e4d36_0
7ff60ea5cca53ce4_0
808f9a66ab4a4f45_0
81793eec88d9f365_0
83fab719e9507dc8_0
85b5e776ab80e385_0
868fa222a0f4b7a5_0
86f146380b1bbf65_0
87785720bd702be3_0
87e158aabe9f4345_0
8cdce00e2862f3a4_0
8f44c72b02f94ca0_0
9184ce2036397631_0
922f71bd47674525_0
93a7a2f6d6886763_0
9407e6cb5404537a_0
948181a7e2c175c3_0
95e22c15c996d22a_0
996a1571a34090cb_0
9b316dd71997aa84_0
9d3a5407ffb82474_0
9dacf8d6e728a785_0
a44cbf45f88112c4_0
a54ccc9b7a8c9d32_0
a55ef8859657fdde_0
a9eea384d16aead4_0
a9f8dfc924471eca_0
aac215f590f40fdc_0
ab105db100b4e055_0
acab17858ef6415f_0
aef3e02eb2018fcf_0
b0cee4107858af6c_0
b11207b665d8cd57_0
b1a8a56b0d68452b_0
b8c706be4e9bffc5_0
b93099debfee5689_0
b9babc549f7faeeb_0
ba678a2fbd8c358c_0
c25a1fd1cede6b0e_0
c637c244dc22b75d_0
c7e27f8ecb24bff7_0
cde9091c23a8d296_0
d2994b7e109f2512_0
d58c02093b691364_0
da439f383bd54653_0
dbc127ed64ef71ec_0
de9cb9806965922b_0
e04c785f001c7ea6_0
e1197b8fe0526501_0
e368093ba13e653f_0
e3bba415f3fe120d_0
e60247e81e00e619_0
e797f656845f49bc_0
e7a5b468b3531e48_0
e942e86d78131ddc_0
e9856add7f0c4ef7_0
ea66a77803312c71_0
ebd126d5e17934f3_0
ef5caeb5ccbb2d99_0
fbea061ec2f4904b_0
fc0ec197756c5613_0
fe2d2d102c3a3798_0
the-real-index
the-real-index
the-real-index
the-real-index
DIPS-wal
index
SiteList-Consumer.json
Edge Profile.ico
000003.log
LOG
EdgeEDropSQLite.db
EdgeHubAppUsageSQLite.db
LOG
LOG.old
000003.log
LOG
LOG.old
LOG
LOG.old
000003.log
LOG
LOG.old
ExtensionActivityComp
ExtensionActivityEdge
128.png
messages.json
History-journal
LOG
LOG.old
Cookies
Network Persistent State
Reporting and NEL
campaign_history
Preferences
Preferences
Preferences
README
Secure Preferences
0081af3a46940a30_0
7354fa1bfaa74d40_0
the-real-index
623cd082b6202da0_0
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
05f9117ade39b35b_0
05f9117ade39b35b_1
06819d33dd31b502_0
06819d33dd31b502_1
0f9209db3ff30066_0
0f9209db3ff30066_1
17a0d77bff99f22b_0
17a0d77bff99f22b_1
1f949fe282357276_0
1f949fe282357276_1
2495de0e321cd059_0
2495de0e321cd059_1
2c0cdd554dd2cc63_0
2c0cdd554dd2cc63_1
2ffffbca04fdceec_0
2ffffbca04fdceec_1
34651f1f5e3962e1_0
34651f1f5e3962e1_1
40d0c138bab9b8ee_0
40d0c138bab9b8ee_1
4791ae0cd91edb21_0
4791ae0cd91edb21_1
486826d9e44ad68d_0
486826d9e44ad68d_1
517c6c0e0da520ae_0
517c6c0e0da520ae_1
59d11db12add1cd9_0
59d11db12add1cd9_1
65df916de4a71bae_0
65df916de4a71bae_1
69ed23fc5b9a4ccc_0
69ed23fc5b9a4ccc_1
711e1c98a878ba06_0
711e1c98a878ba06_1
725351b01813be96_0
725351b01813be96_1
7a254c9920a40f5c_0
7a254c9920a40f5c_1
8af98c3f863d97cf_0
8af98c3f863d97cf_1
8b7f6b998d7cc551_0
8b7f6b998d7cc551_1
8f8a40f39c17885a_0
8f8a40f39c17885a_1
9a71944d0c3a81ca_0
9a71944d0c3a81ca_1
9ebe1b5d3c32fc0f_0
9ebe1b5d3c32fc0f_1
a54706d77db92867_0
a54706d77db92867_1
a66a114fdaa96fb3_0
a66a114fdaa96fb3_1
abc6f936a44c7530_0
abc6f936a44c7530_1
ac0fca45321fd75c_0
ac0fca45321fd75c_1
b08c448ad239ab84_0
b08c448ad239ab84_1
b2649399fb68381a_0
b2649399fb68381a_1
ba087bc38414e93f_0
ba087bc38414e93f_1
c566382f459c3fe1_0
c566382f459c3fe1_1
ca83a363a762ae8e_0
ca83a363a762ae8e_1
d56a60de56c54c7e_0
d56a60de56c54c7e_1
da03453aa0243259_0
da03453aa0243259_1
da9d941b26c1ff7a_0
da9d941b26c1ff7a_1
ea153f4c5a8ed11e_0
ea153f4c5a8ed11e_1
eb953f0cb1b9d9ca_0
eb953f0cb1b9d9ca_1
ef6cf95e5a8d15f2_0
ef6cf95e5a8d15f2_1
f23283a60b0a36b3_0
f23283a60b0a36b3_1
f486e12e583a64a3_0
f486e12e583a64a3_1
fbdc8eb591d4753a_0
fbdc8eb591d4753a_1
the-real-index
the-real-index
the-real-index
the-real-index~RFe59049a.TMP
the-real-index
index.txt
index.txt
000003.log
LOG
LOG.old
4cb013792b196a35_0
4cb013792b196a35_1
the-real-index
the-real-index
the-real-index~RFe596826.TMP
000003.log
LOG
LOG.old
Session_13414232966803021
Session_13414232976469322
the-real-index
SharedStorage
LOG
LOG.old
000003.log
LOG
LOG.old
sync_diagnostic.log
sync_diagnostic.log
Web Data
WebAssistDatabase
QuotaManager
QuotaManager-journal
arbitration_service_config.json
default_cloud_config.json
favorites_diagnostic.log
load_statistics.db-wal
000003.log
LOG
LOG.old
000003.log
LOG
LOG.old
2d7bf36c-a5c3-4121-89b3-9e41840cc991.tmp
index
Last Browser
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
index
cache
warnStateCache
Variations
nav_config.json
metadata.json
metadata.json
first_party_sets.db
f_000058
f_00005a
f_00005c
f_000065
f_000066
f_00006e
f_00006f
f_000070
f_000074
f_000078
f_000084
f_00008e
f_000096
Network Persistent State
fa4f6bfb-1b7c-487b-9ec2-d45ab09c4052.tmp
1af313ff-e44f-44b6-8fa8-c63f4b986c00.tmp
e60bc3d1-cbbb-459d-9032-da8c0db83a3a.tmp
content_new.js
32ba74ce-81d0-4c5e-862e-b217b98218f1.tmp
messages.json
messages.json
messages.json
dasherSettingSchema.json
manifest.json
manifest.json
manifest.json
memory/1036-5348-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-4894-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-5182-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-3887-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-5419-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-5405-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-5240-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-5380-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-826-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-5248-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-5136-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1036-827-0x00000000070E0000-0x00000000070F2000-memory.dmp
memory/1036-5305-0x0000000001020000-0x00000000017CE000-memory.dmp
memory/1348-3714-0x0000000001240000-0x00000000019EE000-memory.dmp
memory/1348-5246-0x0000000001240000-0x00000000019EE000-memory.dmp
memory/2488-5369-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-5243-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-5-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-5160-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-5334-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-5115-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-3673-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-8-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-4-0x0000000000C60000-0x0000000000D36000-memory.dmp
memory/2488-5262-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-4420-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-3-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-5394-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-10-0x0000000002EE0000-0x0000000002EEC000-memory.dmp
memory/2488-5219-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/2488-5416-0x0000000000400000-0x00000000008FC000-memory.dmp
memory/3032-11-0x00000000013C0000-0x0000000001B6E000-memory.dmp
memory/4352-1956-0x0000024664650000-0x0000024664726000-memory.dmp
memory/6384-4875-0x0000020641870000-0x0000020641946000-memory.dmp