00b254bb7839546c189db56ac5aaafdff497170d5562101309e585114eeb12c8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

toolbox.exe
Size

392KB
MD5

5455b156bdca383b7d64a2bfbae30075
SHA1

cf84ce4bbf92975a49cb00f23467fc9a423c3fb0
SHA256

00b254bb7839546c189db56ac5aaafdff497170d5562101309e585114eeb12c8
SHA512

5c994eec99b6999f87e84dc2c1a11be90b03494a936c67794a1609f066fef1ff48f83cf9f1afd87f8fb32ee7c2c44689ab47b5ff6f5eaaca39ec99d70db8569f
SSDEEP

6144:46tro1u73BSMKUbi0J/QpFzw2o5EA5W7J6uftd4FXIIv+caadL7On+IMcV:vD3FKLpFzw2MWB4Fa

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1628	autotyper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toolbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autotyper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2184	timeout.exe
1696	timeout.exe
2928	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 850095.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1304	msedge.exe
1304	msedge.exe
1868	msedge.exe
1868	msedge.exe
5972	identity_helper.exe
5972	identity_helper.exe
6116	msedge.exe
6116	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2152	4088	toolbox.exe	86
PID 4088 wrote to memory of 2152	4088	toolbox.exe	86
PID 4088 wrote to memory of 2152	4088	toolbox.exe	86
PID 4088 wrote to memory of 3100	4088	toolbox.exe	87
PID 4088 wrote to memory of 3100	4088	toolbox.exe	87
PID 4088 wrote to memory of 3100	4088	toolbox.exe	87
PID 4088 wrote to memory of 2572	4088	toolbox.exe	88
PID 4088 wrote to memory of 2572	4088	toolbox.exe	88
PID 4088 wrote to memory of 2572	4088	toolbox.exe	88
PID 4088 wrote to memory of 3960	4088	toolbox.exe	89
PID 4088 wrote to memory of 3960	4088	toolbox.exe	89
PID 4088 wrote to memory of 3960	4088	toolbox.exe	89
PID 3960 wrote to memory of 2184	3960	cmd.exe	90
PID 3960 wrote to memory of 2184	3960	cmd.exe	90
PID 3960 wrote to memory of 2184	3960	cmd.exe	90
PID 4088 wrote to memory of 4484	4088	toolbox.exe	94
PID 4088 wrote to memory of 4484	4088	toolbox.exe	94
PID 4088 wrote to memory of 4484	4088	toolbox.exe	94
PID 4088 wrote to memory of 3108	4088	toolbox.exe	95
PID 4088 wrote to memory of 3108	4088	toolbox.exe	95
PID 4088 wrote to memory of 3108	4088	toolbox.exe	95
PID 3108 wrote to memory of 1696	3108	cmd.exe	96
PID 3108 wrote to memory of 1696	3108	cmd.exe	96
PID 3108 wrote to memory of 1696	3108	cmd.exe	96
PID 4088 wrote to memory of 2668	4088	toolbox.exe	97
PID 4088 wrote to memory of 2668	4088	toolbox.exe	97
PID 4088 wrote to memory of 2668	4088	toolbox.exe	97
PID 4088 wrote to memory of 3232	4088	toolbox.exe	98
PID 4088 wrote to memory of 3232	4088	toolbox.exe	98
PID 4088 wrote to memory of 3232	4088	toolbox.exe	98
PID 3232 wrote to memory of 2928	3232	cmd.exe	99
PID 3232 wrote to memory of 2928	3232	cmd.exe	99
PID 3232 wrote to memory of 2928	3232	cmd.exe	99
PID 4088 wrote to memory of 3840	4088	toolbox.exe	100
PID 4088 wrote to memory of 3840	4088	toolbox.exe	100
PID 4088 wrote to memory of 3840	4088	toolbox.exe	100
PID 4088 wrote to memory of 4576	4088	toolbox.exe	105
PID 4088 wrote to memory of 4576	4088	toolbox.exe	105
PID 4088 wrote to memory of 4576	4088	toolbox.exe	105
PID 4576 wrote to memory of 1868	4576	cmd.exe	106
PID 4576 wrote to memory of 1868	4576	cmd.exe	106
PID 1868 wrote to memory of 1200	1868	msedge.exe	108
PID 1868 wrote to memory of 1200	1868	msedge.exe	108
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109
PID 1868 wrote to memory of 2892	1868	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\toolbox.exe
"C:\Users\Admin\AppData\Local\Temp\toolbox.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0e
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c title Alphii's All-In-One Discord Toolbox
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c timeout 1 >nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c timeout 1 >nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c timeout 1 >nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://dl.mediafire.com/file/9myj8xwcjsc269o/autotyper.exe/file
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dl.mediafire.com/file/9myj8xwcjsc269o/autotyper.exe/file
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8fb0946f8,0x7ff8fb094708,0x7ff8fb094718
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6244 /prefetch:8
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6492 /prefetch:8
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6116
  - - C:\Users\Admin\Downloads\autotyper.exe
      "C:\Users\Admin\Downloads\autotyper.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,515397352505008865,11970219526320882831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5136 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
20KB

MD5
631c4ff7d6e4024e5bdf8eb9fc2a2bcb

SHA1
c59d67b2bb027b438d05bd7c3ad9214393ef51c6

SHA256
27ccc7fad443790d6f9dc6fbb217fc2bc6e12f6a88e010e76d58cc33e1e99c82

SHA512
12517b3522fcc96cfafc031903de605609f91232a965d92473be5c1e7fc9ad4b1a46fa38c554e0613f0b1cfb02fd0a14122eaf77a0bbf3a06bd5868d31d0160e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
63KB

MD5
67e59a06ec50dcd4aebe11bb4a7e99a5

SHA1
5d073dbe75e1a8b4ff9c3120df0084f373768dae

SHA256
14be8f816315d26d4bc7f78088d502eff79dee045f9e6b239493a707758107fe

SHA512
6364515e92ed455f837dcc021cc5d7bbab8eac2a61140de17ff6a67dfdbbd8fbdded5ce739d001a0ba555b6693dafdb6af83424d6643ff6efddc46d391b21d95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\481963cd074f1a48_0

Filesize
268B

MD5
c84bb33a555d46e9e46bc5ef89979611

SHA1
7faf03020a048906d30e417b8a99ca38d81ba6c7

SHA256
39a615f2d729918ea5e4e16e8dc506afc134df0951f8bfff393640d6bc763d25

SHA512
927ba29c0fca0f59aaa09abecadf5d1b0f3726184644d58a2e7dcd12784001ae45ee6af7826cf49a1cff386fb28d26a57d9380096763c391602fb533279d98cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\554bfe119429ae2b_0

Filesize
144KB

MD5
0b40d41f2e9e785864e57392a9055823

SHA1
b83778f6da35f3de398acb43dc7a4bf0ce16b5f7

SHA256
1425d266f6552f56cb00df4319145837c3f5870e38cbcd0c547ad5cd81b4769b

SHA512
9b5a330e856449f49a4fe423cb16d8a38c32f7a0a346fe3d55a7c1e1b460992a42086c00aed711cd0ed805382377abfe6e306c8355607c138fac8bd3f4412afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56d6f409590db490_0

Filesize
54KB

MD5
ef230155b7c601755aa4071496935281

SHA1
1b49150decfcacd2a2dfb45c6f673aab251f309c

SHA256
cd252b2952f7bebdea572e10b70da30cc34edd4461ce8da45994893bfbae77bd

SHA512
6b3852b069e365c1f7ca98e2538f35b8610112c7a3bac254b68a0e5df40100c7ef8317681a0207ebbce376d441914b01bbff32dd90f4cb2607ba2e1fcae13cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a8694aaa036738a_0

Filesize
21KB

MD5
81f88674e22a43a2973ca0fa29518261

SHA1
6ddd3bba22d27deae3b885080fd13d37ca43c82a

SHA256
98fb551ed49c46e2cb64d76e9d4296b9e110d22163ce3e5edcd00505d882278c

SHA512
43bddeadfb89793730441c856ca48fdcf54e96d0957761f6d6c19cbbdc9d1ad78538a34eb4ddda308fe615441dc3e6d4cd7b6632c671b7077cce646b94468bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\97b9d193cc171423_0

Filesize
335KB

MD5
75260f6e2f02d44e0928cfa7b691b3fe

SHA1
701103fddee86750125a5860c840f59d125994b0

SHA256
be5cb3885e19911156e47bb1ab105ca80cfef340ece308a8c11e19c67dfae9ef

SHA512
b063431b344521147929c30f5186f0ced800eaabd8e5c0bec83136f7fe22d153264379884f6dee94303ec25e9a0eacb4168728378ccfb0fa31147eca8c4e4d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b13d9848aa9ac2f2_0

Filesize
278B

MD5
cd5fdbea8aff12992094f3b381392a59

SHA1
a74fcd999f4140bc9bf6566433a4c0f795e89cbe

SHA256
1300d1a83acbdb71863df7ddeda87ebb568ed94d42a24954069b144476973f02

SHA512
37dff056c2c2c55b68618749a0610cf8e8ff7a1dd858a224baea5c26ff0cdc7f48b910e146c9f0cc8f51d0384e1725f35811f8e5e68e9a43f449e08160896610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c472784dec098560_0

Filesize
11KB

MD5
615f4e911d2be419c8947cf0a884e6a6

SHA1
4c088fe8443c8cadefc6a1a29c75f0dca7d0f631

SHA256
b7caaa5836405915cf84040889a08c80df31af3fedd2fc29b7ab8c3146d7e0d7

SHA512
a226cd145c3a9eb2b7c9044dfa3913fed5b5a82a6bed512e44fa4a12ad99c577e7a6c15580d5efcbbcee0c25a1efd927c468165110e9abffe1bc11b2b557485c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9d0ba0ecc344c95ad6323a5daa0967a2

SHA1
d2d254dbebddf163c4fa9e9044242df3902b696f

SHA256
ef6703bf92463b2b12ec4ac01683efce801a07256e51cdc3741810ed1a02c1a3

SHA512
24e39645ecd77d23246a0769585365dcb20cc925173ed532767c9b6d98a7d167456abfd14d0208257d693e522fd2fe28c152b6e95fa0eba30ff3d53933938c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
935ce3cc2d67d0789fbf34b2164894ab

SHA1
266ffd5700252ce403454a0c4be2caa41b05fdc1

SHA256
7f9496f3b8a5288c3c2179495db6a64f44b1d9d8afa902e5c74e6a8a80e1a0c4

SHA512
8dd36d845f24197d4937f83d8dc46eb154c7715f0dad9140a2a4c0c75fef83202903899d23a1c232bac9a1d77c5dea8c8c6c3e8ba0d778c69424c42fbdb967fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
272eebb552dae3b08d7827de6472fc3a

SHA1
47b4783c5c7891dba55fab03e7a55616b7854b08

SHA256
8b6336548d447980bb5cd08815a16fee2ff92b20d50167398019b13210ed4b12

SHA512
d11e80c164846d4c34e73ef3a476c6669c8e93d94ca3de851ac6b7df1c3705299a47eeeebcb91ecf24f46f98cbef0f256c08f5828d43308e218f803de501dd82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
aad22fff1ee18df091c14c6523ad992e

SHA1
6207dab1d39d69ff10b6b1db3c3ae9efdab59aeb

SHA256
41cce945c0c22440807cf60abde6b6031ce7cc041a2edc4534207e49482489d0

SHA512
f5f77f4f805242c825abcb1dcb2c4b2d0f8882791ad3c8f085cde89dc8475444aa45716c421d019f1a1ca7967dcaf8ba71ab2ef48c592dac8058ee72fabfa5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
f6df8d25540df6cb3e4dcf2512b7b876

SHA1
332e27fe265dc922a891584bb5b48e722f7e07e0

SHA256
20d7ff8e7eef584730074f205258c4628cab7d00f58d809fb5f9bb22faa9e469

SHA512
b19e25a437bb3be23481799e74aceaa1231685a53294a91833106bebb6f83f75df07ce767d0f82d4928eddcc3e49f7568eb847866ef0769e636d995da844217a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
d34209825e826a7eaae5869e2f39da40

SHA1
e4d6cc2432e0e047100d86d93426db967e5079a6

SHA256
9d3983f2bb041b22f5a63565c7f45d483b64c9758652eee80826972a850f131b

SHA512
17ef5bef499a98d5a2ae927683a8eeb4b1b7342540dbd9cc82e3f64d6afcf0ac10804c246b0e6b156c2c29c2f8896b347053ff2a8eb98b9af593e5db0d202dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3a37b373c429a59d7f59d9e624c7cd6

SHA1
4066568bdb405b52579515bee6aa9788e29c5392

SHA256
348032a3da94118e7d45475866188ca3277f947f70b819a9f77a4ab381a54b8d

SHA512
11d62897dcf8a849baf9194629975b31355cb35f8161f8e36697a8943c8bfe179573ba6a01625fd0103c0bcf969959feb6123032b370777b386d8be0df9e2b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
fc3be8e34521172addc5961fefbba721

SHA1
42ea35b6b30089242e768ef03fc10d46ac91a18b

SHA256
522d4ecbba1d50e6c2100a0cb725aced2b8ce27500915e5945fdb12ce996c063

SHA512
cb0c0f3babcc0b34c0d7a2c5d1bc1856a7fd30b66fc8b19bba60195a7443acf2a37a6511bb6cd8635709bd0fb29d22867ab94168f1e90313eb0f4747054c718e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
0c2398b01551434523cfc64414d4c496

SHA1
d573cb9aa1b22dd4ca1fb9a5188e2bfc67d7a4c6

SHA256
3247cd849ee739b2d46405a64aca719afe669e41329b6fec46e3cc93d1f42844

SHA512
16d41e035a260a5a876352a40d27b43faf838cf051074d04ee0717392cc979a0d7420402ed22b4f0f26dddfca00c11b0bca958f446138c99c2f6028136ca4dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ecf9ee9c06046e0bd0dbb5e02638b11b

SHA1
95a1b710711fa87f7e7f03d8b202464afaa1bccb

SHA256
b82733f5eec44d885f98021b1a4dc0a8961cd64c331f63f312da6deda9dab9ff

SHA512
4b5829ae7fae5e4eb9729fcd79f36398b9a1af46e625e15d618fc94bfb162b553ad6fdc25d34a273ce8fda9a3bd50ba77fe0135fbcadd0b06ad5ca5753827409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
24cd584695feca9c1cecccd12e6b2811

SHA1
231e7f896cc927a9a6c71743fd8bb25ef569bca0

SHA256
5b172452f7ad96b1f0873c0054bae208413a532b74e4d70040cf5ff88bc3278d

SHA512
bfa5539b195028c8f30f62b6fdeccebe110671bac8f23ef5b9dd18d59c2983d0ee955ae1b382d16502aac285305e481645c1e23c6c636d35f5c8ef3fbeb3342c

Download Submit
C:\Users\Admin\Downloads\autotyper.exe

Filesize
40KB

MD5
333dc3ed558f13a88f65a7e2fc153a33

SHA1
e0218f55b3dcf59b0b8e1c823a7c88ddd5f7407b

SHA256
f826ac08e19daed55692644c0aad88f7aebf01ba07178e11dec5b7ad4d2ad8f2

SHA512
fba5913a6706669d85a14b297710cac826d146017d8208b2afb51ec4a05959ec1914d2eb13ee0743a59de84189441a5cccd3c66cf91961a70bb17695230b9575

Download Submit
memory/1628-231-0x0000000000CF0000-0x0000000000D00000-memory.dmp

Filesize
64KB

Download
memory/1628-232-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download
memory/1628-233-0x0000000005700000-0x0000000005792000-memory.dmp

Filesize
584KB

Download
memory/1628-234-0x0000000005890000-0x000000000589A000-memory.dmp

Filesize
40KB

Download