Overview

overview

10

Static

static

10

sysupdate.ps1

windows10-2004-x64

3

sysupdate.ps1

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    490s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 05:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sysupdate.ps1
  • Size 2KB
  • Sample260426-ft7yjset5s
  • SHA256 eb3047f280466a3a78b7fa07f49386d7d79c16ed2a425bab5af8a76f0eea754a
  • MD5 SHA1 SHA512 TLSH
Score
3/10
adwarediscoveryexecutionspyware

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies registry class 41 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sysupdate.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4496
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4588
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2228
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbd181346hb043h4c89hb640h3b6429e72523
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbd181346hb043h4c89hb640h3b6429e72523 --edge-skip-compat-layer-relaunch
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ff94679c188,0x7ff94679c194,0x7ff94679c1a0
        3⤵
          PID:4952
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6442801668305726302,14227802766739331775,524288 --field-trial-handle=2272,i,8029697959308673106,17512382235177837531,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
          3⤵
          • System Time Discovery
          PID:4324
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,14315742963742763999,14710263008922604764,262144 --field-trial-handle=2272,i,8029697959308673106,17512382235177837531,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
          3⤵
            PID:364
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,1266907574383808544,380874271237928729,524288 --field-trial-handle=2272,i,8029697959308673106,17512382235177837531,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
            3⤵
              PID:2684
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3292,i,5736106451726907567,11128859275814491242,2097152 --field-trial-handle=2272,i,8029697959308673106,17512382235177837531,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:2
              3⤵
                PID:2940
          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
            1⤵
              PID:4368
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulta2351bd7h0c63h4e1bhabf1h3364d469b5bb
              1⤵
              • Enumerates system info in registry
              • Suspicious use of WriteProcessMemory
              PID:5596
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x298,0x7ff94679c188,0x7ff94679c194,0x7ff94679c1a0
                2⤵
                  PID:5636
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,2792045908770303984,15473344775126613561,524288 --field-trial-handle=2460,i,10550841004871423673,2631420291072545475,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
                  2⤵
                  • System Time Discovery
                  PID:5852
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,7878013841351948599,7668632586199010309,262144 --field-trial-handle=2460,i,10550841004871423673,2631420291072545475,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
                  2⤵
                    PID:5864
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,9430955620168829737,12317098228086893124,524288 --field-trial-handle=2460,i,10550841004871423673,2631420291072545475,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:8
                    2⤵
                      PID:5924
                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                    1⤵
                      PID:5964
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:3868
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\ApproveStop.gif
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1648
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:17410 /prefetch:2
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:5316
                      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\UndoRestore.xlsx"
                        1⤵
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of SetWindowsHookEx
                        PID:3664

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            the-real-index
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                            • Size 3KB
                            • SHA256 79257e27691016ce546d8c0253ca0d3f4f4fe38c1fb75ea60842bf712370d2e6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            SiteList-Enterprise.json
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                            • Size 2B
                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                            • MD5 SHA1 SHA512
                            Submit Download

                            Edge Profile.ico
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                            • Size 70KB
                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            LOG
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
                            • Size 343B
                            • SHA256 f932c90002ed08961d260e68779940f2dbaf4e252b4d29e60faadd6a1329395f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            000003.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
                            • Size 570B
                            • SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
                            • MD5 SHA1 SHA512
                            Submit Download

                            LOG
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
                            • Size 319B
                            • SHA256 09ec130c845bf1e8e48a0d3dc1d86a04e8f802f50cdcec33e9eb50fd01024ae1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LOG
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                            • Size 331B
                            • SHA256 921b36bdaa2805c53b69398052ddf5cb1856a74cb2413004d67a02763d5c7ae5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Network Persistent State
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                            • Size 61B
                            • SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            SCT Auditing Pending Reports
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            • Size 7KB
                            • SHA256 290d4f557798ba846e9ed81921c4e607c4dae02d769709d3c48481a96c5a5387
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            • Size 7KB
                            • SHA256 07ad9525d00aae0d5213a12360ebd2dbf4a9aa70eee758ee9ef3b8ffb4e92275
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Secure Preferences
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                            • Size 26KB
                            • SHA256 fabdd720212ceb24fd3733dc93da010aa16d0243493fa2609b6afaeba099f9e6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            LOG
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
                            • Size 335B
                            • SHA256 2bac260d08c87726a28c13614f25a54998beb601fc50bbeed99a8919044fa8b9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LOG
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                            • Size 347B
                            • SHA256 b3a9855fae298f7e41645a72ea8e54ff4157217e19abe31764cf0c7ce8c17d79
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            000003.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
                            • Size 175B
                            • SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LOG
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                            • Size 326B
                            • SHA256 48e796882085029e063e3790df3427cdb9ccf9eb385d96fb7b45ac217e3549ad
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Last Version
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                            • Size 14B
                            • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 9KB
                            • SHA256 27f170f5364ccb00a3b7aa0946c3f51b4dd08f9993d8b64775f30290302342cd
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 8KB
                            • SHA256 0c9380738255ccfb6702a7d098bac6064628ff0dbea0de89687ca844bafd0784
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 9KB
                            • SHA256 7cfdec0bab12936b6a5e6aad567496afb188bf8b7d72bf3b08ba19a0d2d5cf95
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 9KB
                            • SHA256 0865a31f9cad878ded207fe9da6d5c1a246fb8f7b4724decacebd875e34ae30d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 8KB
                            • SHA256 8dba82561f39878b309e005f2bb90a1d268ee5de6e52b2392446d0498db0323f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            data_1
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                            • Size 264KB
                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Variations
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                            • Size 86B
                            • SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_1q2da0ru.byf.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1q2da0ru.byf.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            index.dat
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                            • Size 397B
                            • SHA256 3bf0a8316e301cbf0fdce393bb2c2446648538fd359773eafd234fd035e26936
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/3664-224-0x00007FF925780000-0x00007FF925790000-memory.dmp
                            Download

                            memory/3664-223-0x00007FF925780000-0x00007FF925790000-memory.dmp
                            Download

                            memory/3664-265-0x0000019B97BA0000-0x0000019B97BA8000-memory.dmp
                            Download

                            memory/3664-264-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-218-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-219-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-220-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-222-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-221-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-261-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-263-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/3664-262-0x00007FF927810000-0x00007FF927820000-memory.dmp
                            Download

                            memory/4496-10-0x000001A17CF80000-0x000001A17CF90000-memory.dmp
                            Download

                            memory/4496-2-0x000001A17D030000-0x000001A17D052000-memory.dmp
                            Download

                            memory/4496-0-0x000001A17CF80000-0x000001A17CF90000-memory.dmp
                            Download

                            memory/4496-1-0x000001A17CF80000-0x000001A17CF90000-memory.dmp
                            Download

                            memory/4588-13-0x0000000003020000-0x0000000003065000-memory.dmp
                            Download