Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/06/2023, 10:06

230614-l5h2fsga9v 7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2023, 10:06

General

  • Target

    file_pass1234.html

  • Size

    315B

  • MD5

    a34ac19f4afae63adc5d2f7bc970c07f

  • SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

  • SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

  • SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 25 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge C:\Users\Admin\AppData\Local\Temp\file_pass1234.html
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1340
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch C:\Users\Admin\AppData\Local\Temp\file_pass1234.html
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3908
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff9d04c46f8,0x7ff9d04c4708,0x7ff9d04c4718
      2⤵
        PID:3348
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        2⤵
          PID:2708
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4384
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
          2⤵
            PID:2588
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
            2⤵
              PID:4756
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
              2⤵
                PID:2576
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
                2⤵
                  PID:1464
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                  2⤵
                  • Drops file in Program Files directory
                  PID:2008
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff796015460,0x7ff796015470,0x7ff796015480
                    3⤵
                      PID:1520
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4056
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5764 /prefetch:8
                    2⤵
                      PID:4816
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                      2⤵
                        PID:4664
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
                        2⤵
                          PID:4764
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                          2⤵
                            PID:2396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
                            2⤵
                              PID:2212
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                              2⤵
                                PID:4788
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                                2⤵
                                  PID:4968
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3624
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                                  2⤵
                                    PID:4220
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                                    2⤵
                                      PID:1932
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                                      2⤵
                                        PID:4464
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                        2⤵
                                          PID:2080
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
                                          2⤵
                                            PID:3948
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
                                            2⤵
                                              PID:4712
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                              2⤵
                                                PID:4524
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6468 /prefetch:8
                                                2⤵
                                                  PID:4912
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1500
                                                • C:\Users\Admin\Downloads\7z2300-x64.exe
                                                  "C:\Users\Admin\Downloads\7z2300-x64.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Registers COM server for autorun
                                                  • Drops file in Program Files directory
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3044
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
                                                  2⤵
                                                    PID:3668
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
                                                    2⤵
                                                      PID:1696
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
                                                      2⤵
                                                        PID:4708
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
                                                        2⤵
                                                          PID:3884
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14631767722648581231,6025750829491388639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6840 /prefetch:2
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3624
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:1184
                                                        • C:\Windows\system32\OpenWith.exe
                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3352
                                                        • C:\Windows\system32\OpenWith.exe
                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3288
                                                        • C:\Windows\System32\rundll32.exe
                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                          1⤵
                                                            PID:1888
                                                          • C:\Windows\System32\rundll32.exe
                                                            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                                                            1⤵
                                                              PID:1920
                                                            • C:\Program Files\7-Zip\7z.exe
                                                              "C:\Program Files\7-Zip\7z.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              PID:4512

                                                            Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Program Files\7-Zip\7-zip.dll

                                                              Filesize

                                                              98KB

                                                              MD5

                                                              008b3286b6ac2cf91fda4a3d68769a45

                                                              SHA1

                                                              c8d02ce68268801ec4ca8cc01b35128ac29850bc

                                                              SHA256

                                                              f2b6d781eecfccb7f0ee7a43f3142ed5f1fb00b2963c28672a8c13bbcc43c05f

                                                              SHA512

                                                              744e6ecba322b57a16bab4c4c54fefde562de9b9bd49a8e1cc44844e01946870a28989035500a3201c5b71a51718319ad8727029fa9964629a040ab25ae267f7

                                                            • C:\Program Files\7-Zip\7z.exe

                                                              Filesize

                                                              544KB

                                                              MD5

                                                              32fc99e05ce9a9ee20c16b578d1194bc

                                                              SHA1

                                                              c56689622af4cab9fbf1e225245414b69ddd030e

                                                              SHA256

                                                              1d309318d68d9e4b2585e69f5028a4706793c100faadbd083c745169bceae914

                                                              SHA512

                                                              5f20ba2feccd5b10b117afe8b6a23607dd5fb0794d217ef2a20fcb6f1dd3e0687b9da07b4a14065380b5325dd3c6e6b7061a3a5edc52eae2cd8bfb5f36905903

                                                            • C:\Program Files\7-Zip\7z.exe

                                                              Filesize

                                                              544KB

                                                              MD5

                                                              32fc99e05ce9a9ee20c16b578d1194bc

                                                              SHA1

                                                              c56689622af4cab9fbf1e225245414b69ddd030e

                                                              SHA256

                                                              1d309318d68d9e4b2585e69f5028a4706793c100faadbd083c745169bceae914

                                                              SHA512

                                                              5f20ba2feccd5b10b117afe8b6a23607dd5fb0794d217ef2a20fcb6f1dd3e0687b9da07b4a14065380b5325dd3c6e6b7061a3a5edc52eae2cd8bfb5f36905903

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\376db2c6-7349-4ee0-bc4d-cba398a476bd.tmp

                                                              Filesize

                                                              13KB

                                                              MD5

                                                              10231754070b7c3baafd78cf808f611f

                                                              SHA1

                                                              527d422f3a916be5c146fea5aafc06d1685a5aea

                                                              SHA256

                                                              5ff59efd788640fc8f98b5824e88e81e3ae7ae0285521f1a8c7e1ac88ac2c835

                                                              SHA512

                                                              8092ba357ca907cf4c339af998659d387343b040cda262f3a5f25b613bec1bcfc68bce99b205c679e90c43105d83f8420327aa68d15201ecfcd219ad37a9dee9

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                              Filesize

                                                              152B

                                                              MD5

                                                              cd4f5fe0fc0ab6b6df866b9bfb9dd762

                                                              SHA1

                                                              a6aaed363cd5a7b6910e9b3296c0093b0ac94759

                                                              SHA256

                                                              3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

                                                              SHA512

                                                              7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                              Filesize

                                                              152B

                                                              MD5

                                                              1d40312629d09d2420e992fdb8a78c1c

                                                              SHA1

                                                              903950d5ba9d64ec21c9f51264272ca8dfae9540

                                                              SHA256

                                                              1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

                                                              SHA512

                                                              a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              9d52db11d4cc043a281f8251a193a87f

                                                              SHA1

                                                              14de9ae99080fd4c96e08722b4ee5a0d5fa5a2b8

                                                              SHA256

                                                              e1306cfb42c226eb77f81032f696f4aef4ed5ede4398bc8ee953651962e57dd2

                                                              SHA512

                                                              88164cc86b74427687a1e68e1ddd920db0e9100f88ed43065acbe2240a0ac4db651cb11a56b2dedde1fbe39b3eaf86b69e8653c81fe6b6c32c16dc81674526a5

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583fb4.TMP

                                                              Filesize

                                                              48B

                                                              MD5

                                                              4b23b969e9a4e9c26d815e76cd1b1dd5

                                                              SHA1

                                                              4c092cea0ae0e6b675f972f2ef8e7e5b4f882ce9

                                                              SHA256

                                                              779a8d835b70dac980f49fe9fa425cd16532889c880fa1b35f02fc77a28ed5b0

                                                              SHA512

                                                              7a2f37336484fb61d053f51e59047173abe72c0eec687c8cdeb853b6cb18052f60618a24d97d4856106b3aab03334288c6c066b8050b5ec4b1de05dd4d74509f

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                              Filesize

                                                              70KB

                                                              MD5

                                                              e5e3377341056643b0494b6842c0b544

                                                              SHA1

                                                              d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                              SHA256

                                                              e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                              SHA512

                                                              83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

                                                              Filesize

                                                              2KB

                                                              MD5

                                                              48ee57455d280882ac23ecb10a0beade

                                                              SHA1

                                                              dfb4b2ec6393c4295badfed08902e2cc0d8dc8a0

                                                              SHA256

                                                              1d9644041a5893ff71e1d1d0d4a1ef37e209f3034c73fe625db86f08867f0a1a

                                                              SHA512

                                                              703e2252b58263d5510beea85153f84a0f003648b7bbc8421d65c11619cb64d14b25aac9efa990aa2bd81e40aab73513e6e0fbe1205f13d26d55dc308c2ff159

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                              Filesize

                                                              111B

                                                              MD5

                                                              285252a2f6327d41eab203dc2f402c67

                                                              SHA1

                                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                              SHA256

                                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                              SHA512

                                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                              Filesize

                                                              180B

                                                              MD5

                                                              00a455d9d155394bfb4b52258c97c5e5

                                                              SHA1

                                                              2761d0c955353e1982a588a3df78f2744cfaa9df

                                                              SHA256

                                                              45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

                                                              SHA512

                                                              9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              773c7429231f7d8e9a738fc9df4357e0

                                                              SHA1

                                                              649d33b221b88ddd0e622c33db1f62f26e524901

                                                              SHA256

                                                              ac596c4db40f34490265762cdd592d97dfff2885eaa1334353fa105af32f2d16

                                                              SHA512

                                                              d857bac2078f0d15b16a4e406790e2ca27d9ea1733642e2447b894c001292b7e24424271bb17413622f5dfef980bac49991dd2ee0026c37eb10035354f722b29

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              eb10358bfdbd31c6c1358f64b7a9a11b

                                                              SHA1

                                                              23eadc1f7fa357c198b5ab28417817897daf32b8

                                                              SHA256

                                                              ac0305f8e130511a51e0e79d1c453883d559efa32b1b6daaa3f79b96f39e6088

                                                              SHA512

                                                              bef4fbd27da5aa6a5c1c6735456195d97f8426b09562cdc01b4fc46faba16bede067ea10a7b81894357c97deacd7ab31f8a1dff3c4bd605a435c7e01a22cb318

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              5KB

                                                              MD5

                                                              5fe4b64caf7cb011aad893d0b51e0973

                                                              SHA1

                                                              c9f194a59cb2d5d876a9938a3f99af91cb219176

                                                              SHA256

                                                              81097a14875b17279097b9606b10b0e4959622b44d7741c2f8e96ef81406c138

                                                              SHA512

                                                              b5979d296ee235ede11e7eab35338c035932c320e113b4868b1a7cd639c081d8bf95d4246a23666b6984c39b7006b3713420c8efe6fcedf696ec0a599805b61d

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              5KB

                                                              MD5

                                                              7e4e2b3e562a08717b2571a0c7c6851d

                                                              SHA1

                                                              4cbedd984f20c52e9de89cde27b9fdec478306dd

                                                              SHA256

                                                              af85e788081510a5c870ed2b4b619bf002bdffbb980b46917efb27e7ce1ab136

                                                              SHA512

                                                              3d342f6078e0058675b32050330fd2253852b1953de897ccbece2c4cd4e9da6ce58e4f18a79a50cf2d489500711c4f66db11d618dee5e9145d7f570918176191

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              61c076237e8c168a1f6517b1937b16f5

                                                              SHA1

                                                              ed1c51b7dffbb133408a6fb1da35ca9735ac4073

                                                              SHA256

                                                              0d5847ecd5e386b1cc8073bf09197516623e79cb0b923f6816b7a77a4ee94a21

                                                              SHA512

                                                              204461de3b0cffbf36b3e67cf319a3677016aa3092b2a83e7c6b0b351e0b1032bdba8f404b2cf080ffbf29ecfb2e6b00aa2f4c1e3d4a4c46eda662a6769ebb81

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              5KB

                                                              MD5

                                                              c4c0f51d9f787ee59ec1327ab3160276

                                                              SHA1

                                                              1ed0721dff463bf6579e3b37bf8bf0074d371b6d

                                                              SHA256

                                                              69d635a7ee88fb67d98c7bb1105d33719af4ada2dcf13405d96af99af1ecef88

                                                              SHA512

                                                              2fbd5094e920df0d2b499105413edcf78c65a56ded3dc262a7b87f365904b899be2d9e265da5c8f36e107d133d60f2edffb7fa4d16772029fbc7d67a2825d91c

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              f85cfb7cef1ebedc032047e1e9d538ff

                                                              SHA1

                                                              29d74fdb79a049c6620b909ac6c114f992814211

                                                              SHA256

                                                              78f598b1ce6d6cbec9a26216758be6492746518a5016aa59a0151b8225dc6c0d

                                                              SHA512

                                                              c63db12cf7e9602dfc73c6bd545176cae8b4466ed04d40f8762134b3472b36b41a97e4be5ac35e10abd8d468bd51637b91545e8128e38ad9c75cd869648b2779

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                              Filesize

                                                              24KB

                                                              MD5

                                                              1463bf2a54e759c40d9ad64228bf7bec

                                                              SHA1

                                                              2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

                                                              SHA256

                                                              9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

                                                              SHA512

                                                              33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                              Filesize

                                                              24KB

                                                              MD5

                                                              1e79203d0f70092bf25058099947d5c6

                                                              SHA1

                                                              20d5e2bd3a2ef807207bc3981bd5494c34839c0e

                                                              SHA256

                                                              decca6fa6de1f0dcc2b46a7c45e62d1754fda43b509d92393c628d56930851a6

                                                              SHA512

                                                              b06c5cb26083e2ef7a407be262f37d83d9fee4788e30a94ce258639f7c1fb2ccb4e37ca9b77e4fb30c0fa0a9e80f94a5b9719efd2499c87deafc87d260eb0568

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                              Filesize

                                                              16B

                                                              MD5

                                                              206702161f94c5cd39fadd03f4014d98

                                                              SHA1

                                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                              SHA256

                                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                              SHA512

                                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                              Filesize

                                                              41B

                                                              MD5

                                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                                              SHA1

                                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                                              SHA256

                                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                              SHA512

                                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                                              Filesize

                                                              16B

                                                              MD5

                                                              46295cac801e5d4857d09837238a6394

                                                              SHA1

                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                              SHA256

                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                              SHA512

                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              9KB

                                                              MD5

                                                              73e90c72fb6ac38f912da4cbb9291050

                                                              SHA1

                                                              c9e457e414804a2a9616ed9d866c098f49589b9e

                                                              SHA256

                                                              2c9a6389d09016e1c5e72b040857187af7d9903366029cae2b3f29b36ef3c616

                                                              SHA512

                                                              5dc02408284c7d80cafa0dffe3abfa528d44d13c735085984a832c6448ef1062fe89709e2f70f944b49d456c315af013e848f27526d44582cd27cd9840e3f95a

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              13KB

                                                              MD5

                                                              ca9b48b361c4d8f26811ebe9de866b80

                                                              SHA1

                                                              053ca1ac0df85ba32c22f15781cdf5e791abbd07

                                                              SHA256

                                                              cfd61a55b580bd34192c92f949836a86f979ba4749da4bf74431791f105e6164

                                                              SHA512

                                                              5849b8d46f95ffe56b1fdc1303fb5a13cba39197f48b7cb5e02bc879cb3b3962d9668bfedd77512d54573a5aaa452e74d93357b6b16a3b2175626782d3d5e892

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              13KB

                                                              MD5

                                                              38d5407225d76ee5674189b69bd79b31

                                                              SHA1

                                                              730b4ded0347af10f59dbdfbb62e11422b387239

                                                              SHA256

                                                              9ef353a89c167d7bfe31c480526c8e7c0e945b6a426320f9c00e28f081491f75

                                                              SHA512

                                                              002b15515b0d6fcff5e0ea14e3fdfd5650dac803b031358e9ce3d3606c1e80dc5f1a12af0533423050af3825c07a3373d362161384fffc63f6e2efa68724ecd3

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              13KB

                                                              MD5

                                                              f691f2b61f6af346090e9ca74e61eb3c

                                                              SHA1

                                                              522a7509bb19abf91750a969f8916bf49702962f

                                                              SHA256

                                                              d2bb59a55a3c125cafc71ff8946bc12dfa5a0d19c83dc778c3096561f900b90c

                                                              SHA512

                                                              fb95f45497e4120aba82afcfee042e940d154e6926c40dced2393fdbba01c19877ec20710a47915f02c33fe9051b85f95ceef139aa14c5a534c70db0f1b4ff63

                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wssbod4z.2ib.ps1

                                                              Filesize

                                                              60B

                                                              MD5

                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                              SHA1

                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                              SHA256

                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                              SHA512

                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                              Filesize

                                                              3KB

                                                              MD5

                                                              f14af842903a5a3b7a01e92cb3e64f61

                                                              SHA1

                                                              d8d0bf62c39313c221c807ec827148c17f2f2e94

                                                              SHA256

                                                              22c3b16ea8b0b5487a8eec63f2a97c8f6f988ec630fb5a6f7ca0c0bf7710ddc6

                                                              SHA512

                                                              46526b9dc670ca22f7ee4fc9e300d042a5bace86798c71314167fb9acec95e3fdbf0297e6573a140254614cc1412c808c7e18744c7ff052389cfef1dfd2dc214

                                                            • C:\Users\Admin\Downloads\7z2300-x64.exe

                                                              Filesize

                                                              1.5MB

                                                              MD5

                                                              7dbd56de682b4083d28cdc029d7af5a3

                                                              SHA1

                                                              29ea8b5ac6b04ef4ab66358da0b466d34549b20d

                                                              SHA256

                                                              23ab1f43a0ed6a022b441995a8dcf9b9cd08046f73fb66042bdb7eabaf87b7b2

                                                              SHA512

                                                              a91844ebae73e7c36fb51365488bfc5121240423c67224682debb62e6a79e2cb991f83dc818b67bf60b2a53068c695a78c75080cfcbfe6ce2f0e99023b656b7f

                                                            • C:\Users\Admin\Downloads\7z2300-x64.exe

                                                              Filesize

                                                              1.5MB

                                                              MD5

                                                              7dbd56de682b4083d28cdc029d7af5a3

                                                              SHA1

                                                              29ea8b5ac6b04ef4ab66358da0b466d34549b20d

                                                              SHA256

                                                              23ab1f43a0ed6a022b441995a8dcf9b9cd08046f73fb66042bdb7eabaf87b7b2

                                                              SHA512

                                                              a91844ebae73e7c36fb51365488bfc5121240423c67224682debb62e6a79e2cb991f83dc818b67bf60b2a53068c695a78c75080cfcbfe6ce2f0e99023b656b7f

                                                            • C:\Users\Admin\Downloads\File_pass1234.7z

                                                              Filesize

                                                              5.3MB

                                                              MD5

                                                              5d8247884739dbfa2355697f29dff1e5

                                                              SHA1

                                                              93d5cf504819ad65a4b8bac59555153f7135ba81

                                                              SHA256

                                                              1af498ce6c55c10486204397eccd2f633f9169235269c99467f908b5631733d2

                                                              SHA512

                                                              44e8563e4ddd9b0dbb5a912010b32b030da77e36347745d69fc938ff47db51f1d1fc6c71a9a8115256312a0e9f02b6a1ef0639af5de60f3701b6d1eeb3c9c2c5

                                                            • C:\Users\Admin\Downloads\Unconfirmed 422761.crdownload

                                                              Filesize

                                                              1.5MB

                                                              MD5

                                                              7dbd56de682b4083d28cdc029d7af5a3

                                                              SHA1

                                                              29ea8b5ac6b04ef4ab66358da0b466d34549b20d

                                                              SHA256

                                                              23ab1f43a0ed6a022b441995a8dcf9b9cd08046f73fb66042bdb7eabaf87b7b2

                                                              SHA512

                                                              a91844ebae73e7c36fb51365488bfc5121240423c67224682debb62e6a79e2cb991f83dc818b67bf60b2a53068c695a78c75080cfcbfe6ce2f0e99023b656b7f

                                                            • memory/1340-135-0x0000025E41B40000-0x0000025E41B62000-memory.dmp

                                                              Filesize

                                                              136KB

                                                            • memory/1340-145-0x0000025E25CE0000-0x0000025E25CF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1340-144-0x0000025E25CE0000-0x0000025E25CF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1340-143-0x0000025E25CE0000-0x0000025E25CF0000-memory.dmp

                                                              Filesize

                                                              64KB