df422d5f3b33d180e08ec1e941bb5821fa8f0a59f730bcbb4a2f7d9021e7763b

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
openless.exe
Size 47.9MB
Sample260804-c1ad3sbf57
SHA256 df422d5f3b33d180e08ec1e941bb5821fa8f0a59f730bcbb4a2f7d9021e7763b
MD5 dd5783065d7460002e2fff36c964112e
SHA1 48e9c0a7e3f821908997217c855d0fe9013d7e25
SHA512 a734c349b30bfe16b2605e24ea85f3e8bb224e5776bf206220436e46022b29f5d12d6103666d25b541fbd8dcb51a5498f331e40cb634bc6c863ce595c3cb8e32
SSDEEP 393216:C/T9reljPsGIGnXBfy+aJyPeFIPE5QqEKZ5R/4V4/U+Iw+h3FwEssA:C/T9reljPsG7nXRyNaoIPE5flZzTwm
TLSH
T102B73A157B5E95A9D0A7C474864ACAA3AE2130DA0B3679FF24C042393F7EBF05B39714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	openless.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	openless.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	openless.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	openless.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	openless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	openless.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	openless.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2112	msedgewebview2.exe
2112	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4184	msedgewebview2.exe
4184	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1308	openless.exe
1308	openless.exe
1308	openless.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1308	openless.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1308	openless.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4184	1308	openless.exe	90
PID 4184 wrote to memory of 3264	4184	msedgewebview2.exe	91
PID 4184 wrote to memory of 5424	4184	msedgewebview2.exe	92
PID 4184 wrote to memory of 5424	4184	msedgewebview2.exe	92
PID 4184 wrote to memory of 5424	4184	msedgewebview2.exe	92
PID 4184 wrote to memory of 5424	4184	msedgewebview2.exe	92
PID 4184 wrote to memory of 4972	4184	msedgewebview2.exe	93
PID 4184 wrote to memory of 2288	4184	msedgewebview2.exe	94
PID 4184 wrote to memory of 2288	4184	msedgewebview2.exe	94
PID 4184 wrote to memory of 2288	4184	msedgewebview2.exe	94
PID 4184 wrote to memory of 2784	4184	msedgewebview2.exe	95
PID 4184 wrote to memory of 2784	4184	msedgewebview2.exe	95
PID 4184 wrote to memory of 2784	4184	msedgewebview2.exe	95
PID 4184 wrote to memory of 2784	4184	msedgewebview2.exe	95
PID 4184 wrote to memory of 2784	4184	msedgewebview2.exe	95
PID 4184 wrote to memory of 6032	4184	msedgewebview2.exe	96
PID 4184 wrote to memory of 6032	4184	msedgewebview2.exe	96
PID 4184 wrote to memory of 6032	4184	msedgewebview2.exe	96
PID 4184 wrote to memory of 6032	4184	msedgewebview2.exe	96
PID 4184 wrote to memory of 6032	4184	msedgewebview2.exe	96
PID 4184 wrote to memory of 5076	4184	msedgewebview2.exe	97
PID 4184 wrote to memory of 5076	4184	msedgewebview2.exe	97
PID 4184 wrote to memory of 5076	4184	msedgewebview2.exe	97
PID 4184 wrote to memory of 2112	4184	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\openless.exe
"C:\Users\Admin\AppData\Local\Temp\openless.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1308.2216.14231672663973407969 /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.openless.app\EBWebView /prefetch:4 /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x50,0x7ffe4d7b5fd8,0x7ffe4d7b5fe4,0x7ffe4d7b5ff0
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,14459041106785104557,3491148110521840125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2076 --field-trial-handle=1796,i,14459041106785104557,3491148110521840125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1796,i,14459041106785104557,3491148110521840125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3524 --field-trial-handle=1796,i,14459041106785104557,3491148110521840125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810 /prefetch:1
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4004 --field-trial-handle=1796,i,14459041106785104557,3491148110521840125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4184 --field-trial-handle=1796,i,14459041106785104557,3491148110521840125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openless.app\EBWebView" --webview-exe-name=openless.exe --webview-exe-version=1.3.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4896 --field-trial-handle=1796,i,14459041106785104557,3491148110521840125,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1ed8d7d177774778c294bbe3387035ca6666b810
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F4
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 13c256696db50ebce60f0f3a76f80031137931265d101ede54c19fab6456621d
MD5 3a19d4cb7313c56f1ec592608dfd4240
SHA1 a24b8742aedc6f3efe49d3dc053c6f786a87a9c1
SHA512 93e1b7d6aadcd84cab32c5c7ca743ed6565561f5fd30504ff119a5dcad9555251964d970c925a61cfa52a571587ff8f11b7c793c15e542e381bf805cff692583
TLSH
T1E5D01253B2410574C4202133314275580940C11F40164000982D867E5B044509907481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b5a003a492c0be33dac9ed8161547fcac62d5560a861d383df4c00d3c02dc1e2
MD5 99a0df6e1b098a8bc019ffbef6f7ddd4
SHA1 0ac99264238e41c135f364eca4b4f28686dfe2a6
SHA512 9cb7550bd9d2150124136c0e6497c48047ed26ee7217e8b09d0a8cdbd5b710f54c4b9de57904559ec2cb06a7613152dc3e1d575eaa2abba51d093080368a81b6
TLSH
T169D004D1D1400450C4141135715455700740445504330500451501754540500D007040
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 f1f120dec542a5c5eae5a42dfdbc72b6638e952a06c45eab89d5a2cb0c6fe909
MD5 20ea2e789e60b30719167c809f4b1aa1
SHA1 26916bd3102222c83745bc4fc301337a3257e237
SHA512 ab6fb77976c0867a2664fc7565846848bfab9557462fbffdf73661aeb2f5c55bea0dcec9661ac9967230c4f4e41be660067000a6d68500d010a93b1ee526b8bd
TLSH
T110E08C4D68A67321DB83D97903D23D543DF1470043875ECE9197C1BD8DD7379928128B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e65f.TMP

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e65f.TMP
Size 48B
SHA256 04fe6b827e70b8663ed274c42a5d609b6374395b6d9ee52225688a1c5a1ceac5
MD5 99351b189610b62a2fd82157ea717bb5
SHA1 739afbcc3fd06da4c34de355f6c9e4a3646fca3a
SHA512 8acf21c17c8bc7f8ddc76ecc6122a4bfa56d0f42728d5130d082c6e459c1ded55708ea5d57a866a95924f83326869dfd4743107bb3381fdc7f1723c67b3fffa9
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ab7a9.TMP

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Network\Network Persistent State~RFe5ab7a9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Preferences
Size 6KB
SHA256 5ed75a29e7ad8872d0dfe195884bcc4df5cabd438e0da5321de8520635e78798
MD5 7637a3396e6b5790ceea54844b0abf6d
SHA1 99728f9c65655314e5a4b517cfe8b46470a5acef
SHA512 a372eee7be437335c454f85d109c4c9a4649c9b3e49c88e2945c70c9fa117271149979671f8ea491afc661d4a3a3fe7f140659424b59d8b575ccc7ae8eeb8cac
SSDEEP 96:stv/d9RQGmb9AkMo5h16Z0irs7/x+6MhmuecJiuG0MkkjerK+gUV28XM1C7K:st331ronirsV+FdiuG0wjROVG6K
TLSH
T175D1C8055E64797B8CC7E118BA39BB53E2F9507264D42E58E7FC552C04EA5CD6303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f689dda0-580a-466b-9b9e-6e7c7b9e3ec0.tmp

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Default\f689dda0-580a-466b-9b9e-6e7c7b9e3ec0.tmp
Size 6KB
SHA256 e7c9e4407008b78a771767cbc5382ddfab3df5c2df07546fcdfe451124c0bee2
MD5 aedba4547b942476f0a7ced7d416d085
SHA1 03697c693500e913c13774466ffcef26b6f1d937
SHA512 9baf8e7307134cdc41c4f25c39cd109477716a005904f50401f5c0b5a071680ddaa3bcc0e0a27781a32e9792f86bd3f646aee7532d6d581678679c6e6411527a
SSDEEP 96:stv/d9R5mb9AkMo5h16Z0irs7/x+6MhmuecJiuG0MkkjerK+gU128XM1C7K:st33PronirsV+FdiuG0wjRO1G6K
TLSH
T1E7D1C6055E64797B4CC6F108BA39BB43E2F9607260D42E58E7FC462C08EA6CD6307E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Local State
Size 2KB
SHA256 f79b0c930fd8aea997cefe7a51cad500d9ce4dc5ba2aa9b6f3c489b59c5c19fe
MD5 3ad347b7d303e10b759b0ca4f56705b2
SHA1 2caa923753355c827f0bd6a88a1e38e357ee57ea
SHA512 d758036419add48830e3399a376446053168467e27dd7fba23623cae01789265ceb172351ad11fb89b2195e2904d13ed1eee7a4ed6ded15c1e853c03069dca13
TLSH
T1BA519537AC58A7378AF34604B8567B239E769162EA622F659BDC1B0C01C719D2301C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Local State
Size 3KB
SHA256 5d924ef16ef4b608041580526204e032dc3780f0e34e0325c78908ecd1688160
MD5 5e2efdf70518ce881bc7b7c0be27d520
SHA1 8c9df3bafb36bcd84591c8083e0327b4a8873e30
SHA512 6df58556cd03a11adaa2dfb4a95b2813f71f0a3487d4536dfe96ccdb1c3a7e1265fb7884f21e3f85d0ed1a3b829543e5f0dbe329e262a97fdb21b281741cd6c0
TLSH
T12E61983B6974A6278EF39A04B8867717BBA55123E5953FA5D6EC0F0D01D72C82341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5990dc.TMP

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\Local State~RFe5990dc.TMP
Size 1KB
SHA256 742c80008371f1702256a30b6bab442b743cc4c6d58e994bcec5b768ced028d0
MD5 e1e1a48b9865366ce219f5f036c34d4d
SHA1 ca967a48dae95fd5c47b7380ade80c295f399c82
SHA512 b4c78d850aebcb9e4fe492a95f7e6602252b0bfa176d59d4386ccf9640ab376a9780b41c66ec66feaa8e8c2a3945c22b65877f302d5054170c95611dafb85bff
TLSH
T103218477D8A86B33ECD61346B052B7676F326123C6610F15A3DC0B1D02D30CDA22AD32
MD5 SHA1 SHA512 TLSH

Submit Download

db9dc338-a7d9-4c87-9956-6a79575226a2.tmp

Path C:\Users\Admin\AppData\Local\com.openless.app\EBWebView\db9dc338-a7d9-4c87-9956-6a79575226a2.tmp
Size 15KB
SHA256 13f63ea277b1e34ee514e993bd604130430a942c180f2b547b37a062a18136da
MD5 4fe2e9e96799d5960c665a65edee68db
SHA1 6c2a0f0ca6f02b9df467a750378a37ca5a87c729
SHA512 2982c208fd642ddcd86a5e4e1c7295a61408dc62492ba70728e7685429d7a409fce247491e4a33de43b172f914c8d6328e43d0969e36ade1a26903793cd77971
SSDEEP 384:5+aQikB+z/xvxjg/qhEONBShIz7V2d6Ce9z2:k/UxvxjgC+49O6CeF2
TLSH
T15F72AE2FD5B97E2795F7E6057D190B8BCEB994B291813EB84AED2F0D06C32D81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2112-351-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2112-349-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2112-359-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2112-360-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2112-358-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2112-356-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2112-355-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2112-357-0x000001C484600000-0x000001C484601000-memory.dmp

Download

memory/2784-104-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp

Download

memory/5424-231-0x0000027DE6A70000-0x0000027DE6A9F000-memory.dmp

Download

memory/5424-28-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp

Download