Overview

overview

7

Static

static

7

URLScan

urlscan

1

https://login.micros...

windows10-2004-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    299s
  • max time network
    264s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 03:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://login.microsoftonline.com/common/oauth2/v2.0/authorize?experience_revision=rev-4.2&hardware_class=foldable&surface_type=embedded_view&connector_profile=CONNECT-Z9&compute_engine=engine_node_lts&orientation_lock=portrait&permission_model=scope_read&sync_strategy=burst&geo_zone=NORDIC&second_factor=none&journey_schema=schema-2.9&time_reference=Asia%2FRiyadh&interaction_id=478543fb-b113-4c24-855e-0d9d8dc9b62d&regulatory_profile=ccpa_basic&platform_release=macOS15&trace_hash=lk3QkFh5&ad_experiment=experimental&content_spacing=comfortable&ui_framework=glass_pro&orchestration_id=orch-901&access_scope=admin_full&cache_strategy=priority_cache&network_region=eu-north&viewport_mode=command_view&referral_con88778788text=compliant&language_pack=en-CA&telemetry_session=ts-eb72312b-593b-43d4-8187-d8a654b365fd&narration_style=friendly&ingress_priority=urgent&response_format=text&load_%20policy=lazy&sound_profile=compressed&layout_philosophy=analytical&connection_quality=poor&entitlement_tier=member&navigation_model=floating_hub&skin_profile=glass&distribution_channel=reseller&endpoint_fingerprint=ccb32599-0ff7-4b6f-88da-237ca3a855a0&language_fallback=sv&session_tier=gold&deep_link_policy=fallback&prompt=none&diagnostic_trace=diag-kid9bo&checkpoint_hint=auth&release_int777ent=manual_trigger&client_id=8342137b-d21f-41da-af2a-556e134d9e55&log_severity=debug&pipeline_phase=qa&market_partition=REGIONAL&national_id=CA&delivery_network=CloudflareX&journey_variant=express_lane&preview_flag=disabled&handover_key=YibAMSBDAO&payload_format=raw_stream&threat_level=guarded&ui_palette=electricViolet&feature_state=off&api_contract=api_v2&redirect_url=https%3A%2F%2Fonedrive.live.com&alliance_code=POLAR-STACK&runtime_channel=safe_mode&execution_mode=server_side&hardware_profile=DellXPS15&signal_source=orbitPulse&luminance_profile=light&trace_reference=TRACE-9011&request_pattern=batch&%20retry_marker=Gb2oQosu&cache_directive=public&experimental_state=active&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&client_build=build-1021&visual_variant=variant_y&helpdesk_channel=care%40apple.io&monetary_unit=SAR&audience_class=internal&composition_layout=grid&verification_policy=strict&campaign_track=trustInitiative&topology_version=topo-2.0&engagement_vector=automation&solution_unit=workspace360&client_fingerprint=s74GrcvPQIfyTo5T&render_strategy=balanced&deployment_ring=validation&security_posture=isolated&routing_vector=rv2&credential_type=opaque&experiment_label=lab-route-11&presentation_mode=inspector&[email protected]&ui_channel=inline_module&audience_bucket=segment_delta&traffic_origin=campaign_mail&execution_path=secure_mesh&capability_bundle=ai_enterprise&primary_language=th&identity_protocol=idp-6.0&authorization_model=webauthn&capability_switch=adaptive_ui&media_focus=video_first&authentication_flow=secure_token&resilience_mode=man%20ual_only
  • Sample260511-d8b4baes4r
Score
7/10
discoveryphishing

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Loads dropped DLL 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://login.microsoftonline.com/common/oauth2/v2.0/authorize?experience_revision=rev-4.2&hardware_class=foldable&surface_type=embedded_view&connector_profile=CONNECT-Z9&compute_engine=engine_node_lts&orientation_lock=portrait&permission_model=scope_read&sync_strategy=burst&geo_zone=NORDIC&second_factor=none&journey_schema=schema-2.9&time_reference=Asia%2FRiyadh&interaction_id=478543fb-b113-4c24-855e-0d9d8dc9b62d&regulatory_profile=ccpa_basic&platform_release=macOS15&trace_hash=lk3QkFh5&ad_experiment=experimental&content_spacing=comfortable&ui_framework=glass_pro&orchestration_id=orch-901&access_scope=admin_full&cache_strategy=priority_cache&network_region=eu-north&viewport_mode=command_view&referral_con88778788text=compliant&language_pack=en-CA&telemetry_session=ts-eb72312b-593b-43d4-8187-d8a654b365fd&narration_style=friendly&ingress_priority=urgent&response_format=text&load_%20policy=lazy&sound_profile=compressed&layout_philosophy=analytical&connection_quality=poor&entitlement_tier=member&navigation_model=floating_hub&skin_profile=glass&distribution_channel=reseller&endpoint_fingerprint=ccb32599-0ff7-4b6f-88da-237ca3a855a0&language_fallback=sv&session_tier=gold&deep_link_policy=fallback&prompt=none&diagnostic_trace=diag-kid9bo&checkpoint_hint=auth&release_int777ent=manual_trigger&client_id=8342137b-d21f-41da-af2a-556e134d9e55&log_severity=debug&pipeline_phase=qa&market_partition=REGIONAL&national_id=CA&delivery_network=CloudflareX&journey_variant=express_lane&preview_flag=disabled&handover_key=YibAMSBDAO&payload_format=raw_stream&threat_level=guarded&ui_palette=electricViolet&feature_state=off&api_contract=api_v2&redirect_url=https%3A%2F%2Fonedrive.live.com&alliance_code=POLAR-STACK&runtime_channel=safe_mode&execution_mode=server_side&hardware_profile=DellXPS15&signal_source=orbitPulse&luminance_profile=light&trace_reference=TRACE-9011&request_pattern=batch&%20retry_marker=Gb2oQosu&cache_directive=public&experimental_state=active&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&client_build=build-1021&visual_variant=variant_y&helpdesk_channel=care%40apple.io&monetary_unit=SAR&audience_class=internal&composition_layout=grid&verification_policy=strict&campaign_track=trustInitiative&topology_version=topo-2.0&engagement_vector=automation&solution_unit=workspace360&client_fingerprint=s74GrcvPQIfyTo5T&render_strategy=balanced&deployment_ring=validation&security_posture=isolated&routing_vector=rv2&credential_type=opaque&experiment_label=lab-route-11&presentation_mode=inspector&[email protected]&ui_channel=inline_module&audience_bucket=segment_delta&traffic_origin=campaign_mail&execution_path=secure_mesh&capability_bundle=ai_enterprise&primary_language=th&identity_protocol=idp-6.0&authorization_model=webauthn&capability_switch=adaptive_ui&media_focus=video_first&authentication_flow=secure_token&resilience_mode=man%20ual_only
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe424ac188,0x7ffe424ac194,0x7ffe424ac1a0
      2⤵
        PID:3812
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,2513950888199802112,7644494239288847843,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:3
        2⤵
        • System Time Discovery
        PID:2800
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15103597293871646957,9776433995746362820,262144 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:2
        2⤵
          PID:2520
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,7027192071083958473,15205014049572330800,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
          2⤵
            PID:2368
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6877925458913938800,8015385597566926512,2097152 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
            2⤵
              PID:4324
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1139341570346163275,13447159514744580229,2097152 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
              2⤵
                PID:4892
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,5538426242929373313,14378144621533882720,2097152 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
                2⤵
                  PID:4940
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5128,i,15337120118411946928,401989818620230628,2097152 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
                  2⤵
                    PID:5556
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,16322381053356655423,17206749736373972588,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
                    2⤵
                      PID:3740
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,12854616100419807189,8953873161653454178,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
                      2⤵
                        PID:3408
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,6441290409159066559,16310177353507635309,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
                        2⤵
                          PID:5900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,6441290409159066559,16310177353507635309,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
                          2⤵
                            PID:1660
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4995799920978767749,6518555754913467835,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
                            2⤵
                              PID:4968
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,13070074011729459315,714873364279354605,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
                              2⤵
                                PID:4004
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,2123940420586945853,6052740774916107841,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
                                2⤵
                                  PID:2280
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,12118669996408172298,16636659489176097675,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
                                  2⤵
                                    PID:2440
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,15355728012388938004,10038639226155691105,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
                                    2⤵
                                      PID:2648
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,10647067765149809551,18128938761625881434,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
                                      2⤵
                                        PID:3300
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,16168875735716273780,5478534390508902862,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
                                        2⤵
                                          PID:3628
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,4690392588154618381,2094793701952176115,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
                                          2⤵
                                            PID:5948
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,9359213047994511366,13430905519460917338,262144 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1972
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,6602022515403521085,5476840743253112377,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
                                            2⤵
                                              PID:4396
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,14803062459780644178,15085979429832379110,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
                                              2⤵
                                                PID:1940
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,14799600672534818492,11609101318631748738,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
                                                2⤵
                                                  PID:5264
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,4027719456435085353,8116163977017919772,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
                                                  2⤵
                                                    PID:5956
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13518898297082539202,5342132115199354811,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
                                                    2⤵
                                                      PID:2336
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,16673105371550625386,8983258457748435237,524288 --field-trial-handle=2908,i,15136933204708164883,6175810163680506554,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
                                                      2⤵
                                                        PID:3732
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:1836
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                        1⤵
                                                          PID:4180

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              keys.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1187927885\keys.json
                                                              • Size 8KB
                                                              • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1187927885\manifest.json
                                                              • Size 79B
                                                              • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1482138555\manifest.json
                                                              • Size 141B
                                                              • SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1543583380\manifest.json
                                                              • Size 102B
                                                              • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2081300130\manifest.json
                                                              • Size 177B
                                                              • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2127850628\manifest.json
                                                              • Size 119B
                                                              • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_385609085\manifest.json
                                                              • Size 165B
                                                              • SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_5209732\manifest.json
                                                              • Size 52B
                                                              • SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              autofill_bypass_cache_forms.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                              • Size 161B
                                                              • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              edge_autofill_global_block_list.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                              • Size 6KB
                                                              • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              v1FieldTypes.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                              • Size 509KB
                                                              • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              500ea2cb-a402-4309-a864-c53f30490f9a.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\500ea2cb-a402-4309-a864-c53f30490f9a.tmp
                                                              • Size 15KB
                                                              • SHA256 77fb68b0ec267644a41fad1b8445ce55a0a4a885e8454a0e0c2e357ef016f7c5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              BookmarkMergedSurfaceOrdering
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              BrowsingTopicsState
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                              • Size 414B
                                                              • SHA256 c424f2e282044e424bf70a7ba5357fccf19ef5fce23a952fb0414ed398b13d17
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 3KB
                                                              • SHA256 db9a8833d28bd461cbc3186185dc383764158e8237c0cb0a36dae99f3aed148c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe58842f.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58842f.TMP
                                                              • Size 3KB
                                                              • SHA256 d8587a16da22e83aba8b41fd8ae18597f183784df3720a82dea9d6248758c066
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              HubApps
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                              • Size 106KB
                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 3KB
                                                              • SHA256 af892f9d3964ad084abd218ac2f2f2294038090de7c857042759f050f87c72a9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 4KB
                                                              • SHA256 aed87dbd4ebd0480f13edadab250bc283ec9bd6f59b53d814c646da99a353d3d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 16KB
                                                              • SHA256 3af6c74f12bfc1b4732b4a72e1711447e00bf8ba07b42f82a1d1670652f0f84b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 35KB
                                                              • SHA256 28632030905bdfd6ea73a1a46b7f0c37c5ef77b4f8190cc864a9b2d971810701
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 23KB
                                                              • SHA256 52bd08fecaf22b88a5ffed3a511b76f7a17f0c2a78d73efbd89285b61b6237e9
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              CURRENT
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                              • Size 16B
                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              MANIFEST-000001
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                              • Size 41B
                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              domain_actions.dll
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
                                                              • Size 83KB
                                                              • SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.txt
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
                                                              • Size 145KB
                                                              • SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 27KB
                                                              • SHA256 aed215d0f3171a4270796fe3d9f119e8313b85fcdaa190f75084b992615e8df9
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 26KB
                                                              • SHA256 ba4ff7852522e9d417e20468ec0370dcf9ce3927f49cdf7ff2531b50ef6ec3e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 32KB
                                                              • SHA256 b702d4789ac3b30d59e7d8b113186b45a220c83f34db15638ed7173449ddeb7e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 27KB
                                                              • SHA256 ede1b03aa87d6ad7839a6d6815d4bc7ea2e5e3b0c721382a84f097442d245cfe
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              crs.pb
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
                                                              • Size 233KB
                                                              • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ct_config.pb
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
                                                              • Size 16KB
                                                              • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              kp_pinslist.pb
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
                                                              • Size 10KB
                                                              • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              well_known_domains.dll
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
                                                              • Size 572KB
                                                              • SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              507dd53a-a7b7-4859-8951-e4118f611e7c.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\507dd53a-a7b7-4859-8951-e4118f611e7c.tmp
                                                              • Size 1KB
                                                              • SHA256 8aa7822750fd8d768439e006bce399fcffde523ea759200a08ce077ede6885af
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 1KB
                                                              • SHA256 b6c3bbddbc7675021380825dd278b4b90112aefc9554a8de67382cd679cbc402
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 1KB
                                                              • SHA256 78074841d6b283765026727eaeeca224af34096400fae48e61444ded96f75f68
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 1KB
                                                              • SHA256 4f0e3af291a110e776182178be84acbd1aa23250e0d7fd50dd0c88a21ba8143a
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 1KB
                                                              • SHA256 e0d2cfec3cf1daabc5c40f317881a8466caa6ff199fc7aa0e8b73249e3d67eb8
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 1KB
                                                              • SHA256 488e4bb64475b39f917dd9c6a80cef17bb63fc2912a4ed74af5a88cab315ae40
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 1KB
                                                              • SHA256 13333966642d483131d125fb5cc08064bf2fc738cfb78ba9c1f59757cef60f6c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                              • Size 147KB
                                                              • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              f8448557-85bf-4b2b-9356-ddaf0266ef7f.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8448557-85bf-4b2b-9356-ddaf0266ef7f.tmp
                                                              • Size 26KB
                                                              • SHA256 3db96bf1ab447f721c05b9bb5ef931ad9dc4564ba1f96e3a66ccfbc265582911
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                              • Size 2KB
                                                              • SHA256 22072f43f7402e08fab32f3ab18c6d1da145fdc31d532ca18f7cc8361424190f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              memory/1660-252-0x000001A7C5220000-0x000001A7C5250000-memory.dmp
                                                              Download