0f8fc796bf12b28537ab98f91ffaa4645aa2449296346bd55bd63a2c2bd444fa

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kyan-pro.exe
Size 4.8MB
Sample260930-rrgjcssv5m
SHA256 0f8fc796bf12b28537ab98f91ffaa4645aa2449296346bd55bd63a2c2bd444fa
MD5 d4cd71466e9ff856dd8cc535ae02fa5e
SHA1 fd5f3782a054f3e175ea709a9309cb49f5c07736
SHA512 0904ff39a9180f1748436a9e5282446952ad83f40cefd39ec76b66628ae7f3f85455f3372229e8b942040b61f3b889393f9fa54645ffa654894764a1b15e5bf8
SSDEEP 98304:R46xeJd81iECWcRJLuwX+CSr8CCHUGaEquSZZ0xF4xAry5zihCZs:R468DL+CSo90TTvy25XW
TLSH
T1CF36335E4568D0DCDAD07BB44511DEC1BA6B3939BB35C6AC02E9DA21706BFF08D8E809
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan upx

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kyan-pro.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	discord.com
19	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5080-0-0x00007FF7D8660000-0x00007FF7D8F05000-memory.dmp	upx
behavioral1/memory/5080-266-0x00007FF7D8660000-0x00007FF7D8F05000-memory.dmp	upx
behavioral1/memory/5080-287-0x00007FF7D8660000-0x00007FF7D8F05000-memory.dmp	upx

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_2143140046\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_902318748\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_902318748\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_902318748\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_2143140046\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2644_63092996\hyph-uk.hyb	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	kyan-pro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kyan-pro.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2644	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5080	kyan-pro.exe
5080	kyan-pro.exe
5080	kyan-pro.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5080	kyan-pro.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2644	5080	kyan-pro.exe	87
PID 2644 wrote to memory of 2340	2644	msedgewebview2.exe	88
PID 2644 wrote to memory of 2808	2644	msedgewebview2.exe	92
PID 2644 wrote to memory of 2808	2644	msedgewebview2.exe	92
PID 2644 wrote to memory of 2808	2644	msedgewebview2.exe	92
PID 2644 wrote to memory of 2916	2644	msedgewebview2.exe	93
PID 2644 wrote to memory of 4088	2644	msedgewebview2.exe	94
PID 2644 wrote to memory of 4088	2644	msedgewebview2.exe	94
PID 2644 wrote to memory of 3140	2644	msedgewebview2.exe	95
PID 2644 wrote to memory of 3140	2644	msedgewebview2.exe	95
PID 2644 wrote to memory of 3140	2644	msedgewebview2.exe	95
PID 2644 wrote to memory of 3056	2644	msedgewebview2.exe	118
PID 2644 wrote to memory of 3056	2644	msedgewebview2.exe	118
PID 2644 wrote to memory of 540	2644	msedgewebview2.exe	120
PID 2644 wrote to memory of 540	2644	msedgewebview2.exe	120
PID 2644 wrote to memory of 1312	2644	msedgewebview2.exe	121
PID 2644 wrote to memory of 2420	2644	msedgewebview2.exe	122
PID 2644 wrote to memory of 2420	2644	msedgewebview2.exe	122

C:\Users\Admin\AppData\Local\Temp\kyan-pro.exe
"C:\Users\Admin\AppData\Local\Temp\kyan-pro.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5080.2588.10626416602197040573
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x13c,0x16c,0x7ffbbc1cb078,0x7ffbbc1cb084,0x7ffbbc1cb090
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2192,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4328,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4560,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView" --webview-exe-name=kyan-pro.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=928,i,10406322827657758515,1185647644163364245,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8
    3⤵
    PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2644_2143140046\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2644_2143140046\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2644_902318748\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 72a7d9ea63e80bf28b22bc6f015c7e9fed613b9717658c2ce2947e236d4bd1b4
MD5 aa34ca71ce3768b5df3e683f62d2fce8
SHA1 0cfc32668eed9d5dedfd16919cee60d6c5241be4
SHA512 b10ac344abc8ec2590b85427b453558945c08b531e565ccf421252a75c56147e35c45fdbc7b44d986095d77749c79d2a9a8729a70e8df859babb05bd75193ff7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a44f9205f4cea931b69458f012e11c3efb2ee1b7fa5a61a92ba2c0473dd5ad7c
MD5 8b4aa3736a573a1a9e02db1b6d81d5a4
SHA1 80f2f07e0141209309eab5d73cec1f82c904fa84
SHA512 575af809d97b89fc10c1d13af00a2a16473cf332eaa3b1a5193322c5f5ee8e248b9c7b9dd21b7d1a30fa85853bec588dde8c2a316181f4e4b2009d8100bee362
TLSH
T195D012163A53C174C41020730103A10C0480C11B42598180943D871E5A140501D13441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a6087ba8150add3455bfc40bc958c4dcc75f01c615c2f627f28c37e31c215790
MD5 aa721fe215ab8315bbe854f597626b28
SHA1 871210891b8df113fc89d2b62891bd45581c5314
SHA512 2659b1831bcda09b8c57534cbb6d95192ebd02a946156274edeee848161019308ee0feb23abf0388fac63f95ef67b00e460d60718ea99327322ee1d5a92c0e35
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 b8707de39e0b5cb44a385bc40947425bc2bae79fbaa607a45641ada18fdd0353
MD5 43d7d8fb5ea4dff60f7d36ff6ab89a37
SHA1 2a6ea63b96eefefbc1e7504627b5218f82a8e0a5
SHA512 400df7cbaa2d8e9412ce4fc40858d3171d6dfc55d0ddf1b36225064cec6d53de8859432fd0d19a6f5d098fcbf7f9b67160e2c67b85418e4ed5d2961c2f53ef4c
TLSH
T1E3B012204C524644C770433001C2096C31370DF103930D53039F413C7C7A3980303682
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a06e7.TMP

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Network\Network Persistent State~RFe5a06e7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Preferences
Size 6KB
SHA256 08561cf63ab7825f74a4d81a35a1638143e14c2b40ad4fc3b4e435cb7e0165b1
MD5 517169fcae587ea010eac90b86713f39
SHA1 3686a5694b3ea6d755746b7adb5f3fcff1b72d19
SHA512 6605319f4b422a842ad8f9a8cc0ce09cce237dd04c15cf38b04db180f884da3d6c5f8603d24344777276e2cd56936e6c79ac54f5886e357b294b1de44b19205f
SSDEEP 96:stb05dlAfbihb9effHZ8i0vhEpktom/7qx+WVHMSm+uecJ5u1idQjdP+g7SkMEB:stb0ZwfPZ8paQB/S+WiT5uwd2P4kM8
TLSH
T1C3D1A8025F68BD778CC7E2197A35BB56E2FA106261D40E98EBFC852C04E66CC6307D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Preferences
Size 6KB
SHA256 9a5781285770fb1ba6607e8b93c2b867d87d29dd00d65b26874a202d12bca4d1
MD5 99a94353d363d5002019776b395b05d3
SHA1 ce056a451ea3cfd7fad5b5e4c0b2dd9b74514979
SHA512 03f9820572d500b48bc0782fe44d768c1f5309f6e2007014218b6415003937d767b8026a7372aa2950190802fb04cf0a12f6c20ccd1d134eb7e68b41d9b38a69
SSDEEP 96:stb05dlAfbihb9/ffHZ8i0vhEpktom/7qx+WVHMSm+uecJ5u1idQjdP+g7jkMOB:stb0ZBfPZ8paQB/S+WiT5uwd2PVkMC
TLSH
T1E3D1B8125F68AD778CC7F6197A35BB56E2F6102261D40E98EBFC862C04E66CD6307C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\GraphiteDawnCache\index
Size 256KB
SHA256 d2bf3f15f96ab6f0b2ef0d08da51c60785b57e98d4426df40cc96af5c54d607c
MD5 18f4184ec743f546fcf4c83ac462a3eb
SHA1 d46fcccba564a95034700925ec23bcbaac9b099c
SHA512 87da5baa7f2987d593d3abdb7c9ba7720f26d8b569013358f7ff90c697ff4fb3da1c763f6f97b2b6a54707d41d04ca07b7cc2e86d1454935de9f2c630aff3672
SSDEEP 3:LstlNllklkXlO+:LsX3lPO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Local State
Size 1KB
SHA256 8eafffc4e84d85fc2d1583427102b9df31031027914fc5f52e3506ec0bc5e033
MD5 523df192c5a6fc7201a9a0dc1e855312
SHA1 c0fe72dafe1184b4cb1a52684fb8c74ff00d4e13
SHA512 f3a86dda3f48a56eb3057da5b3c62e877f7b3b49c8326d0a661a8c2638e51d916a6a528666db2169afcb357d84a9df4a500658c80e3dd564e7fee5c4db3e8878
TLSH
T1693185B2D5D06F72ECC2668AB6536ADF2E30106E81614E8C62DD072C02E71CC652ADB7
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Local State
Size 2KB
SHA256 06f9ca14ab7b883d072cf9783f73d4ae68c0eb53a321dcfa3982e14f10a3ac86
MD5 03c5ae6befa95e81857a43f58bfdb8e9
SHA1 4e3bc309f1827c139df080a3f0e0e849ab220cbd
SHA512 346ecd8132c632e4acc72a3a8d2c74e920309a086e8da7b2b5f4e45f3a7f912720c72cffb8e9bc70e4c16d0b49496c1e66c78da6f5f682dd28e2600ea0839ed4
TLSH
T1F251E973A944AF77CDE34A48BD4A3F9F9A30506991622F98A9DC0B1C01EB59C3302C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Local State
Size 3KB
SHA256 3a77b9a57bab11f976040fdc617725467579b6ed4f51eeca6d8c3fbe128b791f
MD5 a239d14698cf4073cfa2200923cdc12c
SHA1 1012401b841a44a4100c6b991ffee53d901a3fc4
SHA512 778dbbd3bbdcc9d5d56a15240229d3d4f5278ce1d2aca45007bc070d422e66ad87023e1d532aa8734c615756fb89446a00f4014ee4ab8fab28c5d98beb27fc48
TLSH
T1CF71A672AAA4EA378DE39A45B9862B5EB660103BD1D13FD8D9EC0F1C01D73882302C57
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Local State
Size 16KB
SHA256 a72b3caf32913ab36c405d9ca5594d9094913b7494ce46e2f3b0cce67f01635e
MD5 74154a9978e080cf3094f4d7ee33c2ba
SHA1 452c47c47bd00f1c62972c0dc4e634e2d366c76f
SHA512 2dbc9eb760f63319d7f762b4cd391a732e17028182563fbf7f7746d39238a8b135325b9f3b6f5f5e684deb7fedeaeb23ad24d928445d360b7f330669ab504a42
SSDEEP 384:zj+aQikB+z/xvxjg/qhEXNbcGQmbhJV/b9zL:2/UxvxjgC+1lbhJdFL
TLSH
T178729F2755A87E2798F7F905BA8D0B9FDBB444B290C15EBC5AED4F0D06C72D81302D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58e0a7.TMP

Path C:\Users\Admin\AppData\Local\Temp\kyan-pro\webview\EBWebView\Local State~RFe58e0a7.TMP
Size 1KB
SHA256 72ea5ab810120df088fb0266cba92b076e5f490f14caf711e2f6679e5645c244
MD5 deb22a430acff318d8e8add1bc02947c
SHA1 acd54114f5b731893bc214181eb9e41a19137c31
SHA512 eb0df1b6cc0e77be32fcbaba21ad26021a0af166a3758438a5947bea5bc89d44ea1e7c424dd6ff45964bddb0adaf47fd7431b3d294d7dc860badf649dd925a9a
TLSH
T1962165B3C4D46F76E8C5598AB553AACF2D2014AE81604F4CA1DC031C02E75CC5536CB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/540-444-0x000001EA4DBA0000-0x000001EA4DBD0000-memory.dmp

Download

memory/1312-461-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-457-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-459-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-462-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-458-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-456-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-460-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-450-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-451-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/1312-449-0x000001B68E4B0000-0x000001B68E4B1000-memory.dmp

Download

memory/2420-488-0x0000023102DD0000-0x0000023102E00000-memory.dmp

Download

memory/2808-271-0x00000175E5E60000-0x00000175E5F8A000-memory.dmp

Download

memory/2808-26-0x00007FFBD7980000-0x00007FFBD7981000-memory.dmp

Download

memory/3056-415-0x00000230AC310000-0x00000230AC340000-memory.dmp

Download

memory/3140-130-0x00007FFBD7980000-0x00007FFBD7981000-memory.dmp

Download

memory/4088-77-0x00007FFBD8730000-0x00007FFBD8731000-memory.dmp

Download

memory/4088-284-0x000001DEB7570000-0x000001DEB75A0000-memory.dmp

Download

memory/4088-76-0x00007FFBD8B20000-0x00007FFBD8B21000-memory.dmp

Download

memory/5080-287-0x00007FF7D8660000-0x00007FF7D8F05000-memory.dmp

Download

memory/5080-266-0x00007FF7D8660000-0x00007FF7D8F05000-memory.dmp

Download

memory/5080-0-0x00007FF7D8660000-0x00007FF7D8F05000-memory.dmp

Download