b231c67fc102bd1784a10330a0b827e599ad66e08d9dc477f2d6c93efb581f85

max time kernel
29s
max time network
31s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/06/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpclient.dll
Size 3.8MB
Sample260622-tcdj9set7t
SHA256 b231c67fc102bd1784a10330a0b827e599ad66e08d9dc477f2d6c93efb581f85
MD5 3209f3fe564e9fb6eecd3c40a9563dc1
SHA1 c8a648d8703039cad8c630e4066fbce93586f9e6
SHA512 f13de9ab03301af4da9cadb4957030b47864d7ac33a9be58d013014b9836ef7fc271b8ae2f76dc33f5bc79fb9ac30bde17da0abe7189056ed5315f3f44a58c22
SSDEEP 49152:iHIjM8nROo7Wjyp2NLtVKPOfuQjPDyO45tfI9hWlHB:ix6W+sNLvfuQjPeJI9GHB
TLSH
T18D069E07EF911869D45A923189EB9651773CBC481B323BD72E90737A2F723D06D3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 22 IoCs

description	pid	Process	procid_target
PID 4900 created 4144	4900	rundll32.exe	80
PID 4900 created 2116	4900	rundll32.exe	81
PID 4900 created 1244	4900	rundll32.exe	82
PID 4900 created 2224	4900	rundll32.exe	83
PID 4900 created 3396	4900	rundll32.exe	84
PID 4900 created 4764	4900	rundll32.exe	85
PID 4900 created 1736	4900	rundll32.exe	86
PID 4900 created 552	4900	rundll32.exe	89
PID 4900 created 4144	4900	rundll32.exe	80
PID 4900 created 4144	4900	rundll32.exe	80
PID 4900 created 2224	4900	rundll32.exe	83
PID 4900 created 2224	4900	rundll32.exe	83
PID 4900 created 3148	4900	rundll32.exe	92
PID 4900 created 2828	4900	rundll32.exe	93
PID 4900 created 5644	4900	rundll32.exe	94
PID 4900 created 2548	4900	rundll32.exe	95
PID 4900 created 6140	4900	rundll32.exe	97
PID 4900 created 4092	4900	rundll32.exe	99
PID 4900 created 5372	4900	rundll32.exe	101
PID 4900 created 4836	4900	rundll32.exe	103
PID 4900 created 4348	4900	rundll32.exe	102
PID 4900 created 3148	4900	rundll32.exe	92

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4900	rundll32.exe
3	4900	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4900	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2224	chrome.exe
2548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266172944589418"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	rundll32.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4144	4900	rundll32.exe	80
PID 4144 wrote to memory of 2116	4144	chrome.exe	81
PID 4144 wrote to memory of 1244	4144	chrome.exe	82
PID 4144 wrote to memory of 2224	4144	chrome.exe	83
PID 4144 wrote to memory of 1244	4144	chrome.exe	82
PID 4144 wrote to memory of 3396	4144	chrome.exe	84
PID 4144 wrote to memory of 3396	4144	chrome.exe	84
PID 4144 wrote to memory of 4764	4144	chrome.exe	85
PID 4144 wrote to memory of 4764	4144	chrome.exe	85
PID 4144 wrote to memory of 1736	4144	chrome.exe	86
PID 4144 wrote to memory of 1736	4144	chrome.exe	86
PID 4144 wrote to memory of 552	4144	chrome.exe	89
PID 4144 wrote to memory of 552	4144	chrome.exe	89
PID 4144 wrote to memory of 2892	4144	chrome.exe	90
PID 4900 wrote to memory of 3148	4900	rundll32.exe	92
PID 3148 wrote to memory of 2828	3148	msedge.exe	93
PID 3148 wrote to memory of 5644	3148	msedge.exe	94
PID 3148 wrote to memory of 2548	3148	msedge.exe	95
PID 3148 wrote to memory of 5644	3148	msedge.exe	94
PID 3148 wrote to memory of 5644	3148	msedge.exe	94
PID 3148 wrote to memory of 6140	3148	msedge.exe	97
PID 3148 wrote to memory of 6140	3148	msedge.exe	97
PID 3148 wrote to memory of 4580	3148	msedge.exe	98
PID 3148 wrote to memory of 4580	3148	msedge.exe	98
PID 3148 wrote to memory of 4580	3148	msedge.exe	98
PID 3148 wrote to memory of 4092	3148	msedge.exe	99
PID 3148 wrote to memory of 4092	3148	msedge.exe	99
PID 3148 wrote to memory of 4092	3148	msedge.exe	99
PID 3148 wrote to memory of 4836	3148	msedge.exe	103
PID 3148 wrote to memory of 4836	3148	msedge.exe	103
PID 3148 wrote to memory of 4836	3148	msedge.exe	103
PID 3148 wrote to memory of 5340	3148	msedge.exe	100
PID 3148 wrote to memory of 5340	3148	msedge.exe	100
PID 3148 wrote to memory of 5340	3148	msedge.exe	100
PID 3148 wrote to memory of 5372	3148	msedge.exe	101
PID 3148 wrote to memory of 5372	3148	msedge.exe	101
PID 3148 wrote to memory of 4348	3148	msedge.exe	102
PID 3148 wrote to memory of 5372	3148	msedge.exe	101
PID 3148 wrote to memory of 4348	3148	msedge.exe	102
PID 3148 wrote to memory of 4348	3148	msedge.exe	102
PID 3148 wrote to memory of 1900	3148	msedge.exe	104
PID 3148 wrote to memory of 1900	3148	msedge.exe	104
PID 3148 wrote to memory of 1804	3148	msedge.exe	105
PID 3148 wrote to memory of 1804	3148	msedge.exe	105
PID 3148 wrote to memory of 2920	3148	msedge.exe	106
PID 3148 wrote to memory of 4764	3148	msedge.exe	107
PID 3148 wrote to memory of 2920	3148	msedge.exe	106
PID 3148 wrote to memory of 4764	3148	msedge.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffcae07c728,0x7ffcae07c734,0x7ffcae07c740
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,14332837328275140251,2937629358814011075,262144 --field-trial-handle=1944,i,7755661818333742136,3058667991662906259,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:1244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,12402691368606708324,749677468679588826,524288 --field-trial-handle=1944,i,7755661818333742136,3058667991662906259,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,3057372744740484655,17540148461282160078,524288 --field-trial-handle=1944,i,7755661818333742136,3058667991662906259,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2792 /prefetch:13
    3⤵
    PID:3396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2932,i,5827201338695095585,4546298431287664170,2097152 --field-trial-handle=1944,i,7755661818333742136,3058667991662906259,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2956 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,12721683888430518444,15826564744174594993,2097152 --field-trial-handle=1944,i,7755661818333742136,3058667991662906259,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2980 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4160,i,9094804157886487064,12753685059294073750,2097152 --field-trial-handle=1944,i,7755661818333742136,3058667991662906259,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4176 /prefetch:9
    3⤵
    PID:552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,15350488058082081345,13223651251851767138,524288 --field-trial-handle=1944,i,7755661818333742136,3058667991662906259,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffca96ec188,0x7ffca96ec194,0x7ffca96ec1a0
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1656,i,11689970226136519535,10704899698652798162,262144 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,8086808817856409030,1944811457022399962,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,14182042951574938430,10607446740765879719,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7973992279367027742,8622734328204318148,2097152 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8303158996748550069,4403721511917848719,2097152 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4064,i,16185468687373560645,5194525675217993586,2097152 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4032,i,12961775473837241970,6188392100541594725,2097152 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4076,i,7823918807155375316,10099537946116647438,2097152 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:9
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4108,i,5495043291489261251,3679189041489534158,2097152 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,13528751071105918410,3169930320385670327,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,801652470192954927,10495736008081190061,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7791391120224846916,12619951117509186593,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4397011131928381046,10676875732964676372,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,10833567049404608433,5248763349652842598,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,10833567049404608433,5248763349652842598,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,11655500355308981895,11252048935146631801,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1136
      4⤵
      PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,5485942574106097593,3643274300283747454,524288 --field-trial-handle=2140,i,10616601248940923178,4125752798462303657,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 264aad14fcc4e6530435d0ca5ebcbb9e61f1391cc3d02b81ef2a7aeee71f560f
MD5 1bdb65a21e197d2cbd39915077faa202
SHA1 944f460c382c1eef9fa8bc062df923011c0e07cb
SHA512 20f026685479abeabec48909860dce645afec968f3316b3fcd2c9e9c2c8e7c264685caccd7393e69525dc489bb897437f4d94a955e9a2331a377019f10b38005
TLSH
T13FE02BB6C951DC3B2DFD075890241755D60513073B41998B3A3D92088FB1A375996C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 82e1cb9b576bc9a9dfb3ad4014ba0a5d77a5d99dcabdf553a25fb28fa303742a
MD5 33c7e425a5c8eec94a80096d06bc7cb5
SHA1 69ee975e844af7dff23292071b85a735aa892840
SHA512 4a33cd9c35bf4a7394b2e72186c57f0d3802246da1dbd9a682a56ac99c4e070f477af8a5781f311bf235b4049cdaab861cbf156f55f270a5238c66e09dbfffc3
SSDEEP 192:qRCRYVx3xOhv7lpAPRp2O9+Hsb+WNnm1YPCCeO2K0VyIsnAUgtaJ:qRCRaYxRUXB0wlPB2Kw8
TLSH
T1F042C57EEE10753B6CDBC219FA257753D7F9102221912E84EAFC892C19E79DC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d8779288a4718c616d9f8e038021e5873e1918dc7906a1cf77b33c18785761a2
MD5 242e7ed5a2e30a8e2500b2ce17c6f07c
SHA1 3764d4bf58aa434257a4e73ef0f231d8a21319ed
SHA512 78f800c9213a34fc91a3fd5edcfec90a174345d636763cfd43eb832d6060e1135dbaa45c91b1ebac4dd2972d396b4b87c6964fc6f4556bd055ccd36592bb5362
SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:dm7Rkm1tYpBeh2BAoa
TLSH
T12CC312375E71A97759B9BB4EB08E0B1F1EF149A2D920DE82C8D85B0437F97CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 ea71048d43b4b878f21926ebc1ffdbb1c545f66149dfc5bf81a521bfca6cedf7
MD5 149efb7fb91a6941c766e7f66e22ede4
SHA1 1b8963bf185946465e715fef0e3af1980e38ee89
SHA512 f8af3fa61022ffc80febaa86ddc274326a4717957cbb4451570e283f24447b8ea846bf666f30ba64a0c8d8276d89d6d6a3e4c4267c45bbd2fc26e1e9400bbf7c
SSDEEP 6144:OEojpGqeGtHdupMZFKh52m7Rkm1tYpBeh2BAo5:OyqvHgpkFi5B9oBGcAo5
TLSH
T1B23423338D7A6CB44AE8DB05354E0E1F6AF29FDAED2ACDD789C6474463D96880709470
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0df3d8e121f9ea012e33f8219a95acf6b3a53babf53b60080666b17d1217559a
MD5 6a4a2d8c182973b85cff8b669b67c9b3
SHA1 4e7f58176beccfb767e6201b93e6d1a3f487d16f
SHA512 475f5a50380b328b5254fde59c5db521ed9156f38865646a72b12012c87a4b7a65fcf8b259d5b5c99a8f5055c0fc0d0a7f5200287fc6516e0b29804c734d389c
SSDEEP 48:KkWI3K/q8Ly5oITKhSEHy5OIPKzy47tCxtb7F:KkWwK/qiaogKhSWaOEKzy3
TLSH
T13A913E4131BA02523D3E2909B2D5DF5A5985B2933078F42B77E904B21D67E642FFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 433f59aa2a1df4ea92a157dd7d074f6fefde453c0386887ebcbd53a4e8791c3d
MD5 bd666718a7de96ca2029b2fda47515c1
SHA1 fdc5cd973205f65e1715894d2fff5b1550e9110a
SHA512 b235dbb9e47149c544375a28ffec6cb6fa5c50733971429da9fb878f10a9397e1396a1a7e549f52eaaa6d44ba67d9ec3e1253166e68204b643968ac01e0506a3
SSDEEP 192:XGNL6jCQmiUyQITf4SufoPxzYSSus6nImsCSnExDU6:XGNL6qrsfju8YtusnfwDU6
TLSH
T1C002DA75AC6C786BAFB36E45F98737135FA4212BEA852F44CAE81F1C00D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 487a9544b644ebf9878ec9d1e6a977f738c4ca590d789cc4c6e9ad70d9c184b0
MD5 036744149e90172d04464081fce9078b
SHA1 f30b0ac401fec2e7bdc15c5f507dea35ac1ba293
SHA512 f19ae9baf717b0c903853076e9ab763889e02df7f7bf828165d557e89be703655cbdff87f6e643db0338b27c60b6439cab83e1870d5983a9f80c6950230453b9
SSDEEP 192:LGNV6jmQmiUyyTV4SufoPxzYSSus6nIms4SuyjOMwq2DfCU6:LGNV62rVju8YtusnjukM+U6
TLSH
T17112FA75A86C7C67AFB36E58F58736139FB8212BE9856F44CAE41E1C00D769C2306C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4900-117-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-99-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-19-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-17-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-16-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-15-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-50-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-77-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-86-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-122-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-124-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-142-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-151-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-150-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-149-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-148-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-147-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-146-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-145-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-144-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-143-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-123-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-121-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-119-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-118-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-0-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-116-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-114-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-113-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-120-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-115-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-100-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-98-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-18-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-97-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-96-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-95-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-92-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-91-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-90-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-89-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-88-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-87-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-85-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-84-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-83-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-82-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-81-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-80-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-79-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-76-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-94-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-93-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-78-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-14-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-13-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-12-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-11-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-10-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-9-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-7-0x00007FFCAE250000-0x00007FFCAE63E000-memory.dmp

Download

memory/4900-8-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-6-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-5-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-4-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4900-1-0x0000000490000000-0x000000049021B000-memory.dmp

Download