Overview

overview

8

Static

static

1

dac0ef92-9...d5.eml

windows11-21h2-x64

8

dac0ef92-9...d5.eml

windows11-ltsc_2024-x64

1

email-html-2.html

windows11-21h2-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows11-21h2-x64

3

email-plain-1.txt

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    390s
  • max time network
    381s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/07/2026, 14:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dac0ef92-9b19-bb99-ba05-2bc41cf474d5.eml
  • Size 33KB
  • Sample260727-rtgl5svcke
  • SHA256 d26bf5375fbb8777912eb7f10f55c8aeadcef82086787fb0a2f20d23a81dd9e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 50 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\dac0ef92-9b19-bb99-ba05-2bc41cf474d5.eml"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://elink.mics.ae/vtrack?clientid=177946&ul=UgdRUVNIVEhDAwNcDgRSeUFRC1UeAFwdEgVYDgkGUiUVVF0HSFBcSEQC&ml=VQBUVFUFGARMU1MNUh0=&sl=JE8mGDBnGGd9Nh5RDwhYUhxZCldDT1gEHVRFVhhT&pp=0&ga=utm_source%3DNetcore%26utm_campaign%3DTax%2Bfor%2Bdevelopment%2Bsector%2Bwebinar%2Brecording%26utm_medium%3DEmail%26utm_term%3DCampaign&fl=DkcRFBYOSxtJDRdAFk9UXB1WGQFZO1wXKA1XMw==&ext=c2k9T2pOam1VUGlwSGsweGFGbA==
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7ffd76ecc188,0x7ffd76ecc194,0x7ffd76ecc1a0
        3⤵
          PID:1496
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,15914095946134160632,12718877923727670320,262144 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
          3⤵
            PID:1956
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10723973864696975082,17239701529189710743,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
            3⤵
            • System Time Discovery
            PID:1852
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,801450361833434741,10481811365056054998,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
            3⤵
              PID:2412
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,14921645843044471932,13713969949669757314,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
              3⤵
                PID:2248
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,16221819130247129045,13595919271123561800,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                3⤵
                  PID:4620
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,17588093506090980995,4215411542685837972,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                  3⤵
                    PID:4044
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,2114706221937877627,16554570730895346396,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
                    3⤵
                      PID:1652
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4272,i,11872745885823726253,18163754099637795601,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
                      3⤵
                        PID:4304
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,5524681814309839621,8045222012335075584,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
                        3⤵
                          PID:1532
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,5845099473084318074,7448784074724101516,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
                          3⤵
                            PID:2244
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,13811644211991318642,7579369406570401543,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:14
                            3⤵
                              PID:2000
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,8374038546649357846,16393783474840056876,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
                              3⤵
                                PID:232
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,15889734850943951862,8853322984735594682,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
                                3⤵
                                  PID:236
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,159771041010501393,9996083830136682316,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5100
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                    cookie_exporter.exe --cookie-json=1136
                                    4⤵
                                      PID:4272
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16286497702963127949,418493968863032545,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
                                    3⤵
                                      PID:4088
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16286497702963127949,418493968863032545,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
                                      3⤵
                                        PID:4368
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,17684649844399420807,8921582423082494351,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
                                        3⤵
                                          PID:3248
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,10374296091479284138,10596955434420352059,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
                                          3⤵
                                            PID:2092
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,7753131885174233383,468805994024299364,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
                                            3⤵
                                              PID:4856
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,4414602842743517831,541665998835885376,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
                                              3⤵
                                                PID:2784
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,5739117826873591413,8837560882772252465,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
                                                3⤵
                                                  PID:2440
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5084,i,4798402013705967846,3718603381498385619,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
                                                  3⤵
                                                    PID:800
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3568,i,13633288031850621849,16219085102381919470,2097152 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
                                                    3⤵
                                                      PID:1108
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,858061683819092874,17132447689721901124,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:12
                                                      3⤵
                                                        PID:1456
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,17599339546442542144,6913122671182905022,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
                                                        3⤵
                                                        • Modifies registry class
                                                        PID:2000
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,14770383372120823664,1432089560771161796,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
                                                        3⤵
                                                          PID:2856
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,2156638216140269469,2680292718198081963,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
                                                          3⤵
                                                            PID:4808
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,11210014569179782502,15668802387391498746,524288 --field-trial-handle=2172,i,18274282056625325304,8251390202869249563,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
                                                            3⤵
                                                              PID:4624
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:3748
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                            1⤵
                                                              PID:2356
                                                            • C:\Windows\system32\sihost.exe
                                                              sihost.exe
                                                              1⤵
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:6088
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe /LOADSAVEDWINDOWS
                                                                2⤵
                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                • Enumerates connected drives
                                                                • Checks SCSI registry key(s)
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2248
                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                              1⤵
                                                              • Enumerates system info in registry
                                                              • Modifies registry class
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3372
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1464

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 c08bb072a9bffad29d0e3db1ec4f906a346c450e032302ab1b08462b0dacbc9c
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  BookmarkMergedSurfaceOrdering
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                  • Size 6B
                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 19de74366c6cfa441ad00de80dbcefc45304aec9135ca0967858df32f1e64245
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 765203a0eb95a007b0f7e95eaad2415997f91d377b4589bd549ccf5f26aaca0a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 0c6333dd53831a50c2992b496932687eeae087a240de8ec869ae9cb2aac3aa43
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  SiteList-Enterprise.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Edge Profile.ico
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  000003.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
                                                                  • Size 247KB
                                                                  • SHA256 8d0939eae46fad4caa9d85f177619a6fd47f2a45d250f69a953c4bc9bfc2da90
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  LOG
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
                                                                  • Size 351B
                                                                  • SHA256 0fca33307cbdeb870a8aeb0953e34f5ae475aedf038335a07a4e08d025a8cb58
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  MANIFEST-000001
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                  • Size 23B
                                                                  • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  730b74b9-96cc-4216-9a9d-ca41b633a532.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\730b74b9-96cc-4216-9a9d-ca41b633a532.tmp
                                                                  • Size 111B
                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  SCT Auditing Pending Reports
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  d99d8c9c-e6ca-4861-9225-44b64c1e86d1.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d99d8c9c-e6ca-4861-9225-44b64c1e86d1.tmp
                                                                  • Size 6KB
                                                                  • SHA256 72a32142c3f542a96ce1ce39c9fda832a771c76b635aa066f988d869e9fc9698
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  000001.dbtmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\000001.dbtmp
                                                                  • Size 16B
                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 16KB
                                                                  • SHA256 3e3f9606b072dec9a042ddee5d2dbffc4f5082ca3e1c4f5362853e854e7a38b3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 12KB
                                                                  • SHA256 5e5cff4f7172368a25e304754c3113b23fd2a5ce59baaf8dd791bad655918c4b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 14KB
                                                                  • SHA256 9b82f9dd209a6a770af3e85b6eeaf9eea9fabebcd55969f28cdf589b9fa00ae0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Secure Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                  • Size 36KB
                                                                  • SHA256 781da67709a4e7f568028639d6f2ee43096e1e7ce2867bf1948905f1c3d004ef
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ef2da71e-a459-40a8-82ff-b906e99a09c5\index-dir\the-real-index
                                                                  • Size 2KB
                                                                  • SHA256 08b27aa49b0d548100e8a44c69edc2ed405c93eb582cdd4a22b0898545ceeba9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index~RFe591dfe.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ef2da71e-a459-40a8-82ff-b906e99a09c5\index-dir\the-real-index~RFe591dfe.TMP
                                                                  • Size 48B
                                                                  • SHA256 ab6088894b0cbbb6bc0785cfcbee70f023fa735749a183541a23dc827a773732
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  index.txt
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                  • Size 214B
                                                                  • SHA256 cd2c80460f4bc367ad6bbff353eebb17954042f73be60289bf3aa21e054ed674
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  index.txt
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                  • Size 130B
                                                                  • SHA256 d2da1438a7ff9dbf450c0aba60c5ff733fa66e2047647226a1134e493890c5b9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  index.txt
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                  • Size 132B
                                                                  • SHA256 658f77ce52cd7ef1cb0cf1e223b0ada54315254ff6ff8e114d571d8052d497ad
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  index.txt~RFe58f41f.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58f41f.TMP
                                                                  • Size 137B
                                                                  • SHA256 f542dcdd35fa74ff24c5673f10bea855a8379ed8c7b20dc77cd08eb880fe2ea5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                  • Size 48B
                                                                  • SHA256 e86ad335445a82c798b51cf2a8ee6b2f87c185a486ee8132ae21604674fc200c
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  the-real-index~RFe591dcf.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591dcf.TMP
                                                                  • Size 48B
                                                                  • SHA256 525c13d324d1dac05d92dfa62025c1ccde0247f6679186b2da797f041292b1bb
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  sync_diagnostic.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                  • Size 4KB
                                                                  • SHA256 e64fb0a2ebd1339b7900eb5dc59c661889d6585a520b0546c1cc6d8d6a2d53b6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 11KB
                                                                  • SHA256 436fb699417a2437a063c9ad576617f54d28c7da702266ffb732ca97602a4e0d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 26KB
                                                                  • SHA256 a60aefa64bf41501aedb40d2724f34ea9d259d437c44e1d377035657e9ef6ffc
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 8KB
                                                                  • SHA256 dae037b55a98496e5e51d66a3e2f3479f8c804da55b55dadf8bc65a2545bad23
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 20KB
                                                                  • SHA256 08fd7b8d9ebeb57dfc3a38973748137cfbdafd3c42a0ac8b5f0fe8f4e4cbfec8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 8KB
                                                                  • SHA256 35964743898059849f2473bf0e290bdac04a964e6765add4538ff49edcfe8562
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data_1
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                  • Size 264KB
                                                                  • SHA256 fffef24a9bd205616014d82834e9669906924969610b5354c9eb9afb06616dc8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  5eed0e81-fabe-4a40-85f4-8ce90b2d3b9f.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5eed0e81-fabe-4a40-85f4-8ce90b2d3b9f.tmp
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  0b6a02ce-b5ce-4942-8d4a-007f023e764f.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\0b6a02ce-b5ce-4942-8d4a-007f023e764f.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  c008fa14-c2b4-41a6-bd77-557289abf1fa.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c008fa14-c2b4-41a6-bd77-557289abf1fa.tmp
                                                                  • Size 10KB
                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  content_new.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1512_1418108928\CRX_INSTALL\content_new.js
                                                                  • Size 10KB
                                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ba47c60f-83a2-49a6-a6c1-af14baa82ae0.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1512_980028545\ba47c60f-83a2-49a6-a6c1-af14baa82ae0.tmp
                                                                  • Size 153KB
                                                                  • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  CUSTOM.DIC
                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                  • Size 16B
                                                                  • SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  memory/3188-0-0x00007FFD63ED0000-0x00007FFD63EE0000-memory.dmp
                                                                  Download

                                                                  memory/3188-10-0x00007FFDA3E40000-0x00007FFDA4049000-memory.dmp
                                                                  Download

                                                                  memory/3188-7-0x00007FFD63ED0000-0x00007FFD63EE0000-memory.dmp
                                                                  Download

                                                                  memory/3188-4-0x00007FFD63ED0000-0x00007FFD63EE0000-memory.dmp
                                                                  Download

                                                                  memory/3188-12-0x00007FFD61AD0000-0x00007FFD61AE0000-memory.dmp
                                                                  Download

                                                                  memory/3188-3-0x00007FFDA3EE4000-0x00007FFDA3EE5000-memory.dmp
                                                                  Download

                                                                  memory/3188-5-0x00007FFDA3E40000-0x00007FFDA4049000-memory.dmp
                                                                  Download

                                                                  memory/3188-8-0x00007FFDA3E40000-0x00007FFDA4049000-memory.dmp
                                                                  Download

                                                                  memory/3188-67-0x00007FFDA3E40000-0x00007FFDA4049000-memory.dmp
                                                                  Download

                                                                  memory/3188-11-0x00007FFD61AD0000-0x00007FFD61AE0000-memory.dmp
                                                                  Download

                                                                  memory/3188-1-0x00007FFD63ED0000-0x00007FFD63EE0000-memory.dmp
                                                                  Download

                                                                  memory/3188-9-0x00007FFDA3E40000-0x00007FFDA4049000-memory.dmp
                                                                  Download

                                                                  memory/3188-2-0x00007FFD63ED0000-0x00007FFD63EE0000-memory.dmp
                                                                  Download

                                                                  memory/3188-6-0x00007FFDA3E40000-0x00007FFDA4049000-memory.dmp
                                                                  Download

                                                                  memory/3372-990-0x000001927B240000-0x000001927B340000-memory.dmp
                                                                  Download

                                                                  memory/3372-991-0x0000018A788D0000-0x0000018A789D0000-memory.dmp
                                                                  Download

                                                                  memory/3372-987-0x0000018A788D0000-0x0000018A789D0000-memory.dmp
                                                                  Download

                                                                  memory/3372-1028-0x000001937BE60000-0x000001937BE80000-memory.dmp
                                                                  Download

                                                                  memory/3372-1029-0x000001927B770000-0x000001927B790000-memory.dmp
                                                                  Download

                                                                  memory/3372-1089-0x000001937D770000-0x000001937D870000-memory.dmp
                                                                  Download

                                                                  memory/3372-1090-0x000001937D870000-0x000001937D970000-memory.dmp
                                                                  Download

                                                                  memory/3372-1092-0x000001927B5B0000-0x000001927B6B0000-memory.dmp
                                                                  Download

                                                                  memory/3372-1088-0x000001937D770000-0x000001937D870000-memory.dmp
                                                                  Download

                                                                  memory/3372-1106-0x000001937D770000-0x000001937D870000-memory.dmp
                                                                  Download

                                                                  memory/3372-1117-0x000001937E180000-0x000001937E280000-memory.dmp
                                                                  Download