Overview

overview

8

Static

static

3

Exploit-Setup.exe

windows10-2004-x64

8

Exploit-Setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Exploit-Setup.exe
  • Size 214.4MB
  • Sample260930-rnpesshe24
  • SHA256 a8c4d3cc137977c0edbf432a23158a677491a86ef02f4eb1f38d80cd6e3361d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomwaretrojan

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 48 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Exploit-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Exploit-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Users\Admin\AppData\Local\Temp\is-XVVOCD54Z0.tmp\Exploit-Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-XVVOCD54Z0.tmp\Exploit-Setup.tmp" /SL5="$602A4,223313952,859648,C:\Users\Admin\AppData\Local\Temp\Exploit-Setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Users\Admin\AppData\Local\Temp\is-OGSOLHCBE5.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-OGSOLHCBE5.tmp\vc_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3432
        • C:\Windows\Temp\{7E40E219-28A2-4D24-8BED-38567CE1B5F6}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{7E40E219-28A2-4D24-8BED-38567CE1B5F6}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OGSOLHCBE5.tmp\vc_redist.x64.exe" -burn.filehandle.attached=664 -burn.filehandle.self=672 /install /quiet /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:260
          • C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{85BE2E23-AACE-4877-A573-733D224080AB} {C806631C-DBB6-44D8-BBD0-67AC750873E7} 260
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2616
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{3D55C252-674F-48EE-BD90-EEFC192EEA37} {2A7FB916-E851-48E0-AD12-B6AD9A15EC64} 2616
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:820
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{3D55C252-674F-48EE-BD90-EEFC192EEA37} {2A7FB916-E851-48E0-AD12-B6AD9A15EC64} 2616
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3788
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C4CB5722-9647-4445-BA1D-868CF89D4FCB} {090311DA-54BF-4C33-9CE0-660869C952D0} 3788
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4516
      • C:\Users\Admin\AppData\Local\Temp\is-OGSOLHCBE5.tmp\WebView2RuntimeInstallerX64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-OGSOLHCBE5.tmp\WebView2RuntimeInstallerX64.exe" /silent /install
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2724
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4264
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1592
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1172
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1716
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkE2MzJCRUQtODA4Qy00ODk2LUE0NEItNDdGMEM1OUUxMUUyfSIgdXNlcmlkPSJ7RENEQjAyQjAtQ0ZERi00Mzg2LUJGOTItNDY3QkRCRjIwMUNGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDNTVFNEQ2NS1CODQyLTQ4RTMtQkRCOS02OTlDQkEyMjFEMEZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7czhGYW52d2ZNY2Q2Nmc3TFYyUGVhU1I3V1VPdjBsdUY0aHZpaXJUb2srTT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS42NSIgbmV4dHZlcnNpb249IjEuMy4yNDEuMTUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxOTA3MzE5MDMiIGluc3RhbGxfdGltZV9tcz0iNjA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:532
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{6A632BED-808C-4896-A44B-47F0C59E11E2}" /silent /offlinedir "{B6FAF445-1EB1-4DE0-953B-8CACD1FAEB0B}"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:3656
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3496
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1036
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4788
    • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4268
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260930152507.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:360
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260930152507.log" /install
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1672
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{244FEC52-C9D0-456D-9668-DDA067A5BCDD} {D28F1A1A-C158-496E-A1A4-DA3C52F165E9} 1672
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:5100
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Windows\SysWOW64\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3924" "944" "792" "940" "0" "0" "0" "0" "0" "0" "0" "0"
        2⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:1652
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:180
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkE2MzJCRUQtODA4Qy00ODk2LUE0NEItNDdGMEM1OUUxMUUyfSIgdXNlcmlkPSJ7RENEQjAyQjAtQ0ZERi00Mzg2LUJGOTItNDY3QkRCRjIwMUNGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjQ3ODAzRDMtMzJGOC00RTAzLUEwRTEtQzc1QjU3QkFCQkZEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0MC4wLjczMzkuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE4IiBpbnN0YWxsZGF0ZXRpbWU9IjE3ODkxNDA2MTIiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzQzMzYxMjg0NTgzMDAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTMxNzQ4MDciIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxOTQ0ODE2OTgiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Modifies data under HKEY_USERS
        PID:4280
      • C:\Windows\SysWOW64\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "180" "1128" "1056" "1132" "0" "0" "0" "0" "0" "0" "0" "0"
        2⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:2996
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkE2MzJCRUQtODA4Qy00ODk2LUE0NEItNDdGMEM1OUUxMUUyfSIgdXNlcmlkPSJ7RENEQjAyQjAtQ0ZERi00Mzg2LUJGOTItNDY3QkRCRjIwMUNGfSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7NzRBMjA2MTYtNzM1MS00NDNFLTk4OTktOTc4QkIwOEIyRDgzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O0hodkhJV3BVTlpUTW5WMlZUMWxlM2Y1WUpROU9Tb1RENk14SERsQTg5UGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjEzOS4wLjM0MDUuMTI1IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTgiIGluc3RhbGxkYXRldGltZT0iMTc4OTEzOTY0NSI-PGV2ZW50IGV2ZW50dHlwZT0iMzIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjQiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxOTkyNzk3MTEiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1036
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C4341B74-64BB-48EA-BC71-B8B8D8D391D7}\MicrosoftEdgeWebview_X64_150.0.4078.83.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C4341B74-64BB-48EA-BC71-B8B8D8D391D7}\MicrosoftEdgeWebview_X64_150.0.4078.83.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2652
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C4341B74-64BB-48EA-BC71-B8B8D8D391D7}\EDGEMITMP_C10FA.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C4341B74-64BB-48EA-BC71-B8B8D8D391D7}\EDGEMITMP_C10FA.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C4341B74-64BB-48EA-BC71-B8B8D8D391D7}\MicrosoftEdgeWebview_X64_150.0.4078.83.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:1920
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkE2MzJCRUQtODA4Qy00ODk2LUE0NEItNDdGMEM1OUUxMUUyfSIgdXNlcmlkPSJ7RENEQjAyQjAtQ0ZERi00Mzg2LUJGOTItNDY3QkRCRjIwMUNGfSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7MDhCNTE5QjItOTRERC00NDMzLTlFN0UtMTE2Q0I0Mzg0Q0E0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O0hodkhJV3BVTlpUTW5WMlZUMWxlM2Y1WUpROU9Tb1RENk14SERsQTg5UGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1MC4wLjQwNzguODMiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIxOCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MjAwNjg1NTg4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjIwMDY4NTU4OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyMTQ5MDQzMTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MjMzMDI5Mzc1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NTM3OTMwNTQ3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVkPSIxOTc4NTYwODAiIHRvdGFsPSIxOTc4NTYwODAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIxIiBpbnN0YWxsX3RpbWVfbXM9IjMwNDkwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:780
    • C:\Program Files\Exploit Launcher\Exploit Launcher.exe
      "C:\Program Files\Exploit Launcher\Exploit Launcher.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Exploit Launcher.exe" --user-data-dir="C:\exploitlogs\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2492.3656.14017565649212745842
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:632
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\exploitlogs\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\exploitlogs\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=150.0.7871.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=150.0.4078.83 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7fffc155dcf0,0x7fffc155dcfc,0x7fffc155dd08
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3860
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\exploitlogs\WebView2\EBWebView" --webview-exe-name="Exploit Launcher.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --startup-read-main-dll --metrics-shmem-handle=1748,i,1626317083975112663,12928590858650302203,262144 --field-trial-handle=2028,i,3473186101583954818,8158099115704690747,262144 --variations-seed-version --pseudonymization-salt-handle=2032,i,14003954042011807766,5991043176412232653,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2024 /prefetch:2
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2696
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\exploitlogs\WebView2\EBWebView" --webview-exe-name="Exploit Launcher.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=1908,i,9648885927417492433,3870542571567802352,524288 --field-trial-handle=2028,i,3473186101583954818,8158099115704690747,262144 --variations-seed-version --pseudonymization-salt-handle=2032,i,14003954042011807766,5991043176412232653,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2104 /prefetch:3
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:3100
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\exploitlogs\WebView2\EBWebView" --webview-exe-name="Exploit Launcher.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2452,i,7626148051340865356,2475819826402624875,524288 --field-trial-handle=2028,i,3473186101583954818,8158099115704690747,262144 --variations-seed-version --pseudonymization-salt-handle=2032,i,14003954042011807766,5991043176412232653,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2472 /prefetch:8
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4648
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\exploitlogs\WebView2\EBWebView" --webview-exe-name="Exploit Launcher.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3816,i,2973633316294611755,4232867321910722566,2097152 --field-trial-handle=2028,i,3473186101583954818,8158099115704690747,262144 --variations-seed-version --pseudonymization-salt-handle=2032,i,14003954042011807766,5991043176412232653,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3836 /prefetch:1
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:736
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\exploitlogs\WebView2\EBWebView" --webview-exe-name="Exploit Launcher.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=4604,i,14337834158243688802,6929016611804962698,524288 --field-trial-handle=2028,i,3473186101583954818,8158099115704690747,262144 --variations-seed-version --pseudonymization-salt-handle=2032,i,14003954042011807766,5991043176412232653,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4652 /prefetch:8
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2428
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\exploitlogs\WebView2\EBWebView" --webview-exe-name="Exploit Launcher.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=4592,i,4976353518142196431,13627981076585501553,524288 --field-trial-handle=2028,i,3473186101583954818,8158099115704690747,262144 --variations-seed-version --pseudonymization-salt-handle=2032,i,14003954042011807766,5991043176412232653,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4608 /prefetch:8
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4468

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Network Share Discovery

          1
          T1135

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          7
          T1012

          System Information Discovery

          8
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          2
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59756a.rbs
          • Path C:\Config.Msi\e59756a.rbs
          • Size 19KB
          • SHA256 86866704c7582b00955ba7d2da523b182ad13f43dad58a76ce620aaeb5146e91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e597576.rbs
          • Path C:\Config.Msi\e597576.rbs
          • Size 19KB
          • SHA256 60185212545ce17633d5538029513ac1355f95ad8093a0226adc2449544314b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59757d.rbs
          • Path C:\Config.Msi\e59757d.rbs
          • Size 21KB
          • SHA256 34c669a22fe3913327cd319904385ce0ec5d097e90911a0251040da75f34e9ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59758c.rbs
          • Path C:\Config.Msi\e59758c.rbs
          • Size 21KB
          • SHA256 f61e85dd1f467fcad9f70ddc12cfaf839996f09f3f51c2859bf890a5324aba34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Installer\setup.exe
          • Size 5.1MB
          • SHA256 cc7ace132d1903d264633a97b3cbfde5152d61162575b2e730d59edf1f959128
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_7z.data
          • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Installer\msedge_7z.data
          • Size 5KB
          • SHA256 78ba8b213576176bb94eda7ba2d4ec3e16fadd42b5a018329252eb1b80d67994
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CopilotUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\CopilotUpdate.exe
          • Size 22KB
          • SHA256 522c8f015afca0806488995c75fa7d74f3fa381e0b9fba5188b2b85f5923106d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EdgeUpdate.dat
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\EdgeUpdate.dat
          • Size 12KB
          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeComRegisterShellARM64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\MicrosoftEdgeComRegisterShellARM64.exe
          • Size 191KB
          • SHA256 6cb888994b609307d4115749240198ec44e219bdc165f71569b62a35495c73c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\MicrosoftEdgeUpdate.exe
          • Size 202KB
          • SHA256 9a5c0ee0ce2b6a8e425dfe1498163950da4bc5f71a6c3ea7e7bf17b8116f04ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
          • Size 225KB
          • SHA256 199bca2112a853a6846a591cad02e66af326f3524f57feff3b46005b1b69c6c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdateCore.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\MicrosoftEdgeUpdateCore.exe
          • Size 272KB
          • SHA256 38b46aed454c89d4778ac4447177ecb92c779e0033ba7fbe9f9344442421b1cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NOTICE.TXT
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\NOTICE.TXT
          • Size 4KB
          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdate.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdate.dll
          • Size 2.2MB
          • SHA256 1edea292c872308f45e80957dac02951bdb7f44fd2a7d5fee2519ab2814dc68f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_af.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_af.dll
          • Size 29KB
          • SHA256 64ebac0a4abc1c8d368d9b79742948740df4e1d6e6622869fc16226467fe97ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_am.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_am.dll
          • Size 24KB
          • SHA256 2f93a995c1a146ca060aa67d166cd132c1fd6d4ac728a98437a8443569a7839f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ar.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_ar.dll
          • Size 26KB
          • SHA256 4a5e06f0af1e792bc9f8196327b7836dd7f0441449d301df22fb2b38833eb5fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_as.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_as.dll
          • Size 28KB
          • SHA256 114b2bbac164fdd9a44d683a8d0d81a34a5b5a604ff3bae81ddd72e53d855567
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_az.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_az.dll
          • Size 29KB
          • SHA256 c6e1bbd224cc73c04fb2d1a459f4e18e0664f8944dd3323e95a46270d986a1a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bg.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_bg.dll
          • Size 29KB
          • SHA256 ab1e5e11c8e50468f3d886c2606c5fc81bfdbc46071b7dc1e17c82afa186166f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bn-IN.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_bn-IN.dll
          • Size 29KB
          • SHA256 1304a10aa34dae695109128b4183898def571309a81e1a375229b898d43f4d9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_bn.dll
          • Size 29KB
          • SHA256 a4e4cf1ce98842fed8309b56aa20d61858b1fafa183aea144cd4c243118d66a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_bs.dll
          • Size 28KB
          • SHA256 267be1737cdd516fb9d22f14e6fe7f8b5ef124d49c69526d156f6301f1041bdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ca-Es-VALENCIA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
          • Size 30KB
          • SHA256 7ad8edf3870941bb4ea1c26180f91c56b565c781cefec76423d8996064b1be6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ca.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_ca.dll
          • Size 30KB
          • SHA256 ba67ddaad8737cc21af5ce60f841e7128180e5b363f3ac37768a81ff99db5217
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_cs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_cs.dll
          • Size 28KB
          • SHA256 c8d36f34ed0d6cd4e682f51716b5b6171b63bfc03b193b82c0dbeeb1843a05ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_cy.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_cy.dll
          • Size 28KB
          • SHA256 050129118f6e6b2b1d47920266d7e2b03bf5acfc8705f63aeb01ca46160bb0ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_da.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_da.dll
          • Size 28KB
          • SHA256 8c6ea7ddcc74ad287cfc198395e90c14a2975a240e2d9fdb08d7ec5244ecf798
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_de.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_de.dll
          • Size 30KB
          • SHA256 295fc096f2a07ff1549c0540cd9619bfaf2fb28ec5b4d74b0e5f63a2bd242154
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_el.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_el.dll
          • Size 30KB
          • SHA256 cfb6690f4009fbbfad68060fe3ed5045548e35c58f19b51b9b640f3288ca9ab9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_en-GB.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_en-GB.dll
          • Size 27KB
          • SHA256 acd1944585bc0b6c84df0eb93ba557fc08677ddefe1e94221e9b32b95cb28b7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_en.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_en.dll
          • Size 27KB
          • SHA256 8369982752a19800d5d8dcd7d3f8322d4fb84e89037aeed8885efd4de9e92093
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_es-419.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_es-419.dll
          • Size 29KB
          • SHA256 f84e9cd6054d17e851de34b0faba42aefdfdda88516927341ca79b8e079a12c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_es.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_es.dll
          • Size 28KB
          • SHA256 c931fac6a50ca67fb9ca6604ba4b2193926157d2ec350ca47beea42275c9102a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_et.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_et.dll
          • Size 28KB
          • SHA256 ce0d2e709643bf4b08a5d938f9b4c79a1184270c0f9e3cd58500bdf4a46945ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_eu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_eu.dll
          • Size 28KB
          • SHA256 f31f9ae948ad0af3d2c6389430a2c12e251a52566b411ef4c052b896eef11a03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fa.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_fa.dll
          • Size 27KB
          • SHA256 af4654bdf2292828a371be324d9e4ac49c43cf1d15cf8a47390658e3ce18ad51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_fi.dll
          • Size 28KB
          • SHA256 8efa1859500823a7a3f8bf20875913472e70fdbf2c15bb5c6fe2b17731f82ab0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fil.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_fil.dll
          • Size 29KB
          • SHA256 0b9a4370f7fc275864db8efb048f1e4fe3874d0f559dcbde7e35efc43a28509f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fr-CA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_fr-CA.dll
          • Size 30KB
          • SHA256 3cb5ce419c0becce8f7d9b44d95b8f77bbbd39064ff23d6243ca9e64cd0d29af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_fr.dll
          • Size 30KB
          • SHA256 d08d539f134847be029f321b4b1dde4d31ee9aa5b13c913bc8688b0b2132e43f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ga.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_ga.dll
          • Size 28KB
          • SHA256 3a94c8cf158deba6fe319e36d30766949a479ab9ba048f3d351ca83715265433
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_gd.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EU8F17.tmp\msedgeupdateres_gd.dll
          • Size 30KB
          • SHA256 1ffb8a37de7df12c972783d6d61c509bd0a575eb0e4f134186b5d86ad3cd3b3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Exploit Launcher.exe
          • Path C:\Program Files\Exploit Launcher\Exploit Launcher.exe
          • Size 1.4MB
          • SHA256 113f3c15259019e0fdeebf70cc2aeb416cef777ec363a894d55c70c65abbd425
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdate.log
          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
          • Size 330KB
          • SHA256 a556e513d1e3dba3c1ad59d393bd7da635c7c6e008b680cf9d594b86e48f8ffc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
          • Size 980B
          • SHA256 9b30e2fd1f784c44d9a1ac984bef9f6a2d776e41db1d8bf775d0a30de2885409
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260930152507_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260930152507_000_vcRuntimeMinimum_x64.log
          • Size 3KB
          • SHA256 bca1bb3065f2f358ec96f847de5b4943e3ba3ff95c09ab7e4c380f9e308c0a69
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260930152507_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260930152507_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 03b131996b9356c03191bf25d0168c0b2a07f704f9b9d8afa046a5640220e104
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-OGSOLHCBE5.tmp\vc_redist.x64.exe
          • Size 17.9MB
          • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Exploit-Setup.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-XVVOCD54Z0.tmp\Exploit-Setup.tmp
          • Size 4.8MB
          • SHA256 585f517b387d9829d1f1d2157445912a62988d6d8023f037d20b187d57b0cd80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\cab5046A8AB272BF37297BB7928664C9503
          • Size 1.0MB
          • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{08D29CC7-86CB-4CB7-AC74-CB0565A4F7EC}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{7E40E219-28A2-4D24-8BED-38567CE1B5F6}\.cr\vc_redist.x64.exe
          • Size 615KB
          • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{FE7FCD45-B986-4E8A-A9B3-563CB57C7691}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\exploitlogs\WebView2\EBWebView\Crashpad\settings.dat
          • Size 288B
          • SHA256 4465d2dc68dcbd0db14e7c8a621c6f2d2bf724c3bcdb7be50e1de5bacfcb48a2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MANIFEST-000001
          • Path C:\exploitlogs\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\exploitlogs\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT
          • Path C:\exploitlogs\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          data_0
          • Path C:\exploitlogs\WebView2\EBWebView\GrShaderCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_1
          • Path C:\exploitlogs\WebView2\EBWebView\GrShaderCache\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\exploitlogs\WebView2\EBWebView\GrShaderCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\exploitlogs\WebView2\EBWebView\GrShaderCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\exploitlogs\WebView2\EBWebView\Local State
          • Size 2KB
          • SHA256 a8098e39c4f49d87df385a32cc293b2f2b61e8d7a73ccdf6b51862dfd98206d2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\exploitlogs\WebView2\EBWebView\Local State
          • Size 2KB
          • SHA256 a206cbf14b899e848fb532c6815418f8f9143ff0e43cce60c18698ae97cba849
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          b9679767-41e5-47b7-909f-7f3be89f9a35.tmp
          • Path C:\exploitlogs\WebView2\EBWebView\b9679767-41e5-47b7-909f-7f3be89f9a35.tmp
          • Size 1KB
          • SHA256 c3706c2e5eea89b807610edab6406e960a94efea32de0a73d6aa639c068d203a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/736-592-0x00007FFFDD530000-0x00007FFFDD531000-memory.dmp
          Download

          memory/820-227-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download

          memory/1844-6-0x00000000001A0000-0x0000000000281000-memory.dmp
          Download

          memory/1844-0-0x00000000001A0000-0x0000000000281000-memory.dmp
          Download

          memory/1844-484-0x00000000001A0000-0x0000000000281000-memory.dmp
          Download

          memory/2696-516-0x00007FFFDD530000-0x00007FFFDD531000-memory.dmp
          Download

          memory/2784-442-0x0000000000550000-0x0000000000585000-memory.dmp
          Download

          memory/2784-468-0x0000000000550000-0x0000000000585000-memory.dmp
          Download

          memory/2784-443-0x0000000073920000-0x0000000073B63000-memory.dmp
          Download

          memory/3788-226-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download

          memory/4516-224-0x00000000001D0000-0x0000000000247000-memory.dmp
          Download

          memory/4648-596-0x00007FFFDC170000-0x00007FFFDC171000-memory.dmp
          Download

          memory/4648-595-0x00007FFFDC750000-0x00007FFFDC751000-memory.dmp
          Download

          memory/4708-247-0x00000000008F0000-0x0000000000DDF000-memory.dmp
          Download

          memory/4708-483-0x00000000008F0000-0x0000000000DDF000-memory.dmp
          Download

          memory/4708-5-0x00000000013B0000-0x00000000013B1000-memory.dmp
          Download

          memory/4708-7-0x00000000008F0000-0x0000000000DDF000-memory.dmp
          Download

          memory/4708-8-0x00000000013B0000-0x00000000013B1000-memory.dmp
          Download

          memory/4708-72-0x00000000008F0000-0x0000000000DDF000-memory.dmp
          Download

          memory/4708-472-0x00000000008F0000-0x0000000000DDF000-memory.dmp
          Download

          memory/4708-481-0x00000000008F0000-0x0000000000DDF000-memory.dmp
          Download