hxxps://drive[.]google[.]com/drive/folders/1ypIR9V2IgH0E4bxaoJe2w7YX8nUS1deM

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
11-11-2024 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1ypIR9V2IgH0E4bxaoJe2w7YX8nUS1deM

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	nvidiaProfileInspector.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4632	powershell.exe
4356	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
4908	timeout.exe
4236	timeout.exe
2164	timeout.exe
2712	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\EXM Free Tweaking Utility V6.1.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
2008	msedge.exe
2008	msedge.exe
4056	identity_helper.exe
4056	identity_helper.exe
2148	msedge.exe
2148	msedge.exe
1844	msedge.exe
1844	msedge.exe
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe
4780	powershell.exe
4780	powershell.exe
4356	powershell.exe
4356	powershell.exe
4940	powershell.exe
4940	powershell.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4876	WMIC.exe
Token: SeSecurityPrivilege	4876	WMIC.exe
Token: SeTakeOwnershipPrivilege	4876	WMIC.exe
Token: SeLoadDriverPrivilege	4876	WMIC.exe
Token: SeSystemProfilePrivilege	4876	WMIC.exe
Token: SeSystemtimePrivilege	4876	WMIC.exe
Token: SeProfSingleProcessPrivilege	4876	WMIC.exe
Token: SeIncBasePriorityPrivilege	4876	WMIC.exe
Token: SeCreatePagefilePrivilege	4876	WMIC.exe
Token: SeBackupPrivilege	4876	WMIC.exe
Token: SeRestorePrivilege	4876	WMIC.exe
Token: SeShutdownPrivilege	4876	WMIC.exe
Token: SeDebugPrivilege	4876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4876	WMIC.exe
Token: SeRemoteShutdownPrivilege	4876	WMIC.exe
Token: SeUndockPrivilege	4876	WMIC.exe
Token: SeManageVolumePrivilege	4876	WMIC.exe
Token: 33	4876	WMIC.exe
Token: 34	4876	WMIC.exe
Token: 35	4876	WMIC.exe
Token: 36	4876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4876	WMIC.exe
Token: SeSecurityPrivilege	4876	WMIC.exe
Token: SeTakeOwnershipPrivilege	4876	WMIC.exe
Token: SeLoadDriverPrivilege	4876	WMIC.exe
Token: SeSystemProfilePrivilege	4876	WMIC.exe
Token: SeSystemtimePrivilege	4876	WMIC.exe
Token: SeProfSingleProcessPrivilege	4876	WMIC.exe
Token: SeIncBasePriorityPrivilege	4876	WMIC.exe
Token: SeCreatePagefilePrivilege	4876	WMIC.exe
Token: SeBackupPrivilege	4876	WMIC.exe
Token: SeRestorePrivilege	4876	WMIC.exe
Token: SeShutdownPrivilege	4876	WMIC.exe
Token: SeDebugPrivilege	4876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4876	WMIC.exe
Token: SeRemoteShutdownPrivilege	4876	WMIC.exe
Token: SeUndockPrivilege	4876	WMIC.exe
Token: SeManageVolumePrivilege	4876	WMIC.exe
Token: 33	4876	WMIC.exe
Token: 34	4876	WMIC.exe
Token: 35	4876	WMIC.exe
Token: 36	4876	WMIC.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4512	2008	msedge.exe	79
PID 2008 wrote to memory of 4512	2008	msedge.exe	79
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 2560	2008	msedge.exe	80
PID 2008 wrote to memory of 1132	2008	msedge.exe	81
PID 2008 wrote to memory of 1132	2008	msedge.exe	81
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82
PID 2008 wrote to memory of 1628	2008	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1ypIR9V2IgH0E4bxaoJe2w7YX8nUS1deM
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f42c3cb8,0x7ff8f42c3cc8,0x7ff8f42c3cd8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3644535648653777489,8397835212492130693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_EXM Free Tweaking Utility V6.1.zip\EXM Free Tweaking Utility V6.1.cmd" "
1⤵
PID:1364
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
  2⤵
  PID:1088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_UserAccount where name="Admin" get sid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Windows\system32\findstr.exe
    findstr "S-"
    3⤵
    PID:436
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4152
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4236
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:784
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:2344
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:1264
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:4188
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1332
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Downloading resources (power plan, Nvidia profile inspector & more, Press "OK" To continue)', 'Exm Tweaking Utility', 'Ok', [System.Windows.Forms.MessageBoxIcon]::Information);}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2132
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:956
- C:\Windows\system32\curl.exe
  curl -g -k -L -# -o "C:\Users\Admin\AppData\Local\Temp\exm.zip" "https://exmapi.onrender.com/static/free/v5.0/v5.0_free_resources.zip"
  2⤵
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -NoProfile Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\exm.zip' -DestinationPath 'C:\exm'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Downloaded resources successfully, Press "OK" To continue to the menu:Information);}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4976
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://exmtweaks.com/
  2⤵
  PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f42c3cb8,0x7ff8f42c3cc8,0x7ff8f42c3cd8
    3⤵
    PID:2648
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:2164
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1924
- C:\Windows\system32\timeout.exe
  timeout 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2712
- C:\exm\v5.0_free_resources\nvidiaProfileInspector.exe
  "C:\exm\v5.0_free_resources\NvidiaProfileInspector.exe" "C:\exm\v5.0_free_resources\Free NVPI EXM Profile V6.nip"
  2⤵
  - Executes dropped EXE
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
88dc70c361a22feac57b031dd9c1f02f

SHA1
a9b4732260c2a323750022a73480f229ce25d46d

SHA256
43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

SHA512
19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2458cf27bed630a19d2a35ee61cb021b

SHA1
597b4af85bffc2f8c6cb863613ecdd7fa5ea2e8d

SHA256
05eeae104986bb173000a59caaec1f42bfb2d50329f89a9c5273175d0a2951d9

SHA512
57ba72f7a4a30efcc63dd394b2e03ddfea99663c22081bcc6c183f402674298f43ba06afccf9e66e65106e12adced22215d5d5c055ca502976128d69219e8ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
1152b66ad81b0a0d77467e2833127ec3

SHA1
8833c8eb0d2e756ff5e04ec3fc8cca53474902f4

SHA256
4bb29a7d5d197c1c9cd78d789f725729317122e178ccf4410e6bc044a6595541

SHA512
cfd9d0f74fe8fcbe4405ccbf0252231cf4eab55680772dfe0c7ec120b562990de19f0dfb54ac6ed90f0d28d843a4e9f678dea691f5ee1e7503447b159ea52b09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0772d106d7eb9770e94a80793fa62411

SHA1
38d13ef2c257469ee8dfc83e6643ab1bda836c9a

SHA256
67c8ba29c38e3e0f8f67565a7ddd6be815e54a3458286a85455cc42bffc66da7

SHA512
4fc55f7cdb98f52d2d31d3123c30aa44e7f52c67ab18c124f8d1b2bd1a43b84cfffc41dea6fee173c3b6f8f5010c561393b908d5ca3a5901d6be8db07888617b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
414711f5bd1b6d949159c41ae1374f20

SHA1
38d3e3ea336e96dc78e0efdac6e0f5c06abafba1

SHA256
0a502ff7af92a2c085dcbbde8ee9a8aa4c2a58af789e564e29518d5c1c39458a

SHA512
32d41132c0d28dd3a1545d6324946ed8af5873a63c4112634963d6824e356b4647d2839dc53bedfd299ef49c22a2518de08856bf677f1f64741caff213984462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63a40bd70c353fb50186d88a7816cdac

SHA1
477989bf98be7511ad3b5a4b33ea6c9763755161

SHA256
3df7e92da40d4042122bd64eb4c57624ef0b92b39e078cc96c527377e90f644b

SHA512
1235e1dfb5f47df9e3a0cb4ab52f154575574faee3be1ac3ef5ff3f981c35bcaff9affd4dc511c58da03a98901e5a1cf53ba3351a06be82f82b0bb7402245b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b24038951c19b365953690ee9982329c

SHA1
7970bf3c675c26d47c56d422b607ea3a688a409f

SHA256
de2da665e9229779321bacd9a324028eac37116c3ed9af1c8231ba36bf54a4aa

SHA512
fe448ed3766e1f9d7930c966574cf02068af9648f520f29a11ba7cd267629f12707c94aec7cfdd20c82102e8c41bb4ff84ae4340c7ad3517b75c0e2d8e2a77fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c8c18b11a1401b232da425f06ca73ed

SHA1
abc4061200662c69d6796c568b9bf54db50dd8ed

SHA256
9164d4b89847d9b055fba9c2d10d75d07362cf6cd08e3dda76116978d9d985fb

SHA512
9fb25abe25fe5bccab7823b4a176058721d258babe5f735d92264f14329711b9e57e4e9abc67a9105da1f3f832574d0ebc20f1713b47bd39868ede5c2668611a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dabbcc4195976e6dd602d7bb1d23bbd6

SHA1
09ee7d0d1813f172df9fd583dcfa43c13d3bea56

SHA256
2b4d0ef7abb91b0c3948d9439ac491067dcef2726b3e90720e112f31bcd69993

SHA512
635dbd0b81df430bcedc8e12f6653e45bf263a2cc2d1c94c9a9a61ab25d83625b9bf52afa019a261e396ff9a0fd0908cdb834c95822e98b2f8d74d588ea720e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b08f3cca33b0d7978825129368f31ce2

SHA1
45b1d207dc3cd7ec9624f7cdc4098b708384bdf7

SHA256
cede8c6ac2af0c53060455105800f82c94622fd7bc6d299a01d39613c0590b3f

SHA512
71b1f0bf6c3994a710bf36349edb756db9df3309a52f963b398edca0e203958e2e5085ba4d3818fa667f51844e2901a6dbfa2c7500321a76173137685a85b8d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c2ce.TMP

Filesize
1KB

MD5
c324f7b08b0db03417370186c8c8566d

SHA1
fb4d5b84df058a1192927241ae94c4e188aaead0

SHA256
ec7396c7da38aff39bb32cecbdd5eda559552bed7dd5c5e27bcefbbd9863fe91

SHA512
bf58b5f51338f76c7e480a082e939f37058c9e4f33afeed405ad7ad439f9f731ac9997653c1a843b54a39d6f7d1b9416096e795c73bab29aef7acf7fc4e300a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f2825802c53c9934097fe91b38cd967

SHA1
cfde86eaa9bc1c4aaf0a096b07f01948057cd0ea

SHA256
74b4d4125176ae1f50baf5e7b12ff143473ff2691ae07ad10092c8a34b0e409a

SHA512
1fa2fed085b7fbcab8cdda39e56d62eb5fec9c68400c3aa24bd84eaf1587c35827b7ee14487640fdccbe4031e9e84514aeed4595de2bb14566c3f7e943e0153b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2cde37d5175cbc4176e559cc2b9d9bbd

SHA1
c8b7f40f44a827787ad6be7717ca7eafb337ce0c

SHA256
8b5cc406b4429e2db294e76eb02d705746981c9f8ecdaeb0f8bf61e24439c227

SHA512
1001b8ab6677e7a47bd424a75705298ebcd826f55d5b6bf44c113fb6f9ff2c337bbd8753f981ecbf3e8f97d94b4132d443026abeaee3be436fd6a4d09584a288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e656df401d7b40d31a73591cf29ee81c

SHA1
6811512262aea744f34c0d65691991378efb54aa

SHA256
615143d0b0482e03d3c148667fd2622cd708bd2d40f9c1689660180f94c175f1

SHA512
222f8e6faa9b0e86a37c6f43180df0c10b7c8b04cb0531533c799662ed5a3bcba1df12cb6e3fff8dc42b3b39b94d998b62ac7a8bede9ce42c3270862004e84ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3fbf5bcfcac90df66b8df71bcadc721e

SHA1
4a2fee38fcc45b97104b5bfbbf1907ebe41cda67

SHA256
836ccf7e7cb10617bcb18bfc9d0268b22f3222332b3cfe627c407323e438c4ea

SHA512
9528b95baf8ca33eb92fbc647a7954c23f6547863b1ecb30b78bd2f6a68dc443bf1a26e0865bb8b1bdacc02d70d166bcbae72f5457ed122b5a61ce0077c0ae6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
1a11402783a8686e08f8fa987dd07bca

SHA1
580df3865059f4e2d8be10644590317336d146ce

SHA256
9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

SHA512
5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9598b277fe6b7cf90bbbbcffe042b5de

SHA1
ccec371c8363662622145670a2bba7360bbbb59e

SHA256
a6045005178ebac88a78fe8e69c7a13a3e144a4a3dfe0b4db21fe312fcf73e0a

SHA512
e99eaf14a82a66859cd1b9e999c3bf4887b7ab7bcbdf809d593995f15674a991c5b690c04a99d8a1e6fe55944221211cfe4fb0330936d258e59ec15d4f2fb837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
273004c8cfb842eb72f9db1d3646771f

SHA1
d441d303f3278cfa4210ab96e35f41521f2bc1e7

SHA256
35f069e856c5d4d5e8031c4329626111f9036be0fe91aaa7fad8c2cf6e3c1914

SHA512
69a76045e6c07ea41dec302a52e1ff2bf3021be10d8bf2b2b62417eda782ae1e0ad53a00fec081ab17a3421c8e4a201a8913c337e3ca78520f00c13706ac6ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dz13mfbj.ct2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\exm.zip

Filesize
1.2MB

MD5
db0e9e1953431cc977c3e95bd3d36ab6

SHA1
4f34027bfd24a54e269721e07f3fedceb7841e70

SHA256
c4e798355111c34ae3424a1c102758335a5e24f714831b15a5bf2a1303df9097

SHA512
0874095e38b8c5ab0e2f68fddb77ea2283ef6515349417446aef12e6b9e4456c429b156423858830264cbbe9cacc4a32d9cc2325135432bebc0c5b38720fff9a

Download Submit
C:\Users\Admin\Downloads\EXM Free Tweaking Utility V6.1.zip:Zone.Identifier

Filesize
186B

MD5
c7b9af96dc6dbbd108b3d274676bc6e0

SHA1
ab7e043131f2dc3a7a044594db52f4d7bee66e45

SHA256
07778d989546f94e393339a56c4224626965bc8de92e5aebf20dd4c60d990773

SHA512
f3ec6b7fbc812ea4368c00481e4bae1ef587cc10047153f7b7ea3545d011424f4482179a4cd119dd75e44916a2117aeb97ef19c57e50a1a34631025d8cc3dcb5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 91880.crdownload

Filesize
36KB

MD5
9fb407c6b0890549256c5f3a3ecb6cbd

SHA1
337e04b26691d932a3b365072a0a94e417006b7a

SHA256
2b274828909181281f74f7c52e3782060d61b1b61bed5e5a34ea40b7265f5f7f

SHA512
2d81e5b338d9ad036f8febeb2330be8c9cd682dabc8893833faab25d329449630fe8ff56be3e176036ab9ed93188be56ed2cb4bd3914d2673ee7cdee7f6c4c99

Download Submit
C:\exm\v5.0_free_resources\nvidiaProfileInspector.exe

Filesize
535KB

MD5
ff5f39370b67a274cb58ba7e2039d2e2

SHA1
3020bb33e563e9efe59ea22aa4588bed5f1b2897

SHA256
1233487ea4db928ee062f12b00a6eda01445d001ab55566107234dea4dc65872

SHA512
7decec37c80d1d5ad6296d737d5d16c4fc92353a3ae4bd083c4a7b267bb6073a53d9f6152b20f9b5e62ba6c93f76d08f813812a83ce164db4c91107d7ad5a95f

Download Submit
C:\exm\v5.0_free_resources\nvidiaProfileInspector.exe.config

Filesize
158B

MD5
ce6d0bc7328b0fab08de80f292c1eaa4

SHA1
ae505d6f60a71259b91865f6d5a3d674e9de0ebe

SHA256
383b8dcb968b6bd0633658d9bb55c4acaf4c85a075aa456904a42d4e4efd5561

SHA512
f009ad44131f19997c7c7be38144132d9f701fda4492f3782a2717b92859f189196fac5a7d7e6ff6952f2c1735f27ffaddf0f7acbb45b98a7d85572e96c16c00

Download Submit
memory/4356-312-0x0000026FEC4A0000-0x0000026FEC4AA000-memory.dmp

Filesize
40KB

Download
memory/4356-311-0x0000026FEC4B0000-0x0000026FEC4C2000-memory.dmp

Filesize
72KB

Download
memory/4356-436-0x000001778A9A0000-0x000001778AA2C000-memory.dmp

Filesize
560KB

Download
memory/4632-284-0x0000021F2BA20000-0x0000021F2BA42000-memory.dmp

Filesize
136KB

Download