Analysis
- user interaction
yes - max time kernel
1049s - max time network
1051s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 16:15
General
- Target maindoc.xml
- Size 5KB
- Sample260511-tqmebset21
- SHA256 30ac4d14ff35bf8310a511946afb6fec0a7fa29cadc60cabb8a37a90bcad9494
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 54 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\maindoc.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\maindoc.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/maindoc.xml"3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc44e9c188,0x7ffc44e9c194,0x7ffc44e9c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,17727155290739207719,10091668637570296869,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,1226899603996421106,15987581607212756813,262144 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,15392132478169238357,11280538187365620891,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,3921702116821411693,10542862887151934934,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,11500480095457581490,4228382638130720188,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,4138554459930087108,8070142092705215735,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,4129877883356483959,14347319644077790655,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,5180965210299498294,17480183581663999156,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,14089573871391591672,2552114369800925737,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,12627302168531788049,3812431357755002137,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,12370535654023119592,17690666498169528669,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11030388685713693786,6005964642371226355,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,13816616616725673182,15388147733360181247,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,18410115557832613302,14566183680109717387,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,13918687520009060661,4102793911931296718,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,13918687520009060661,4102793911931296718,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,14066034371216679179,13390807316915904625,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,7826258920707979222,7543845246998879446,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17523438565416050274,15714775032052776245,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,14062723555110370957,8594153772388195061,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,7217896838199103624,3751515249227598471,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,13229275323780597448,6052845342469991620,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6712,i,5084687757613850897,5106589223787465047,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6868,i,5825833421887446696,15059491430221040736,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,17747158878678533291,9158794987438496157,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,5758466297182699855,5245983545334856757,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,8987083013871536072,4574224919841514401,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,16040487465125650887,4191390719878271293,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:144⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,1755802928116122162,16210084092935482858,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,15979185270322131545,2927464026731971839,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,2741035212002051041,2931754497113707779,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3890343997147417724,9096733276115017115,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,13680660593810222151,462908436995602824,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6972,i,13950308031870331755,10855085036349719946,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6580,i,12764756861395394459,13176360267039472490,262144 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6568,i,1892498163190481148,13314936082761902189,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6952,i,18393341319737725426,5831826869107617522,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5724,i,15409111516869592084,3535110075651327804,2097152 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,12322352960304121752,6163369724506522430,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,9223051856195795739,11289689314764274795,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,8162904072317304210,17743183855531335559,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,4813192007745225909,1961062360019295692,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,4597893093194715722,7761267294549425524,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,10664601479212658202,18252722917039498687,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,17105265672646094148,9642944218570851384,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,270143085044065395,7710760868439271416,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,9374961943163135890,384335548418632709,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,898180599247744123,8948989789614653391,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,15587158258977785469,15531544262867341256,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,9597945380121086592,5336231645837168514,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,1928411239285540653,5718804711801169241,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,8204066404361014414,11209044798826272295,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3009207339650078751,13974240234081281347,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16305082417962089693,5905850611951279180,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7876,i,17961069676449063317,2425096299884459180,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7872,i,11152388204612722189,860257385866498142,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7716,i,6914654185508170463,17859302940015768330,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,16768490799315217404,4470902528864545719,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,671106073978707480,832160399175279500,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,10795089497642692163,15385951720956003571,524288 --field-trial-handle=2164,i,14675378582875966065,8329393927736628392,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
26d2aac9-56a2-48a5-9440-c912378cfcaf.tmp
blocklist
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_0000b5
f_0000b6
f_0000b7
f_0000b8
f_0000b9
the-real-index
the-real-index
the-real-index
the-real-index~RFe5933a9.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5a610d.TMP
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5ceba0.TMP
index.txt
sync_diagnostic.log
CURRENT
MANIFEST-000001
f6490ab1-82fb-4077-bd41-e108763e669a.tmp
domain_actions.dll
data.txt
OperationConfig
OperationConfig~RFe5941b2.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
manifest.json
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58b07f.TMP
safety_tips.pb
typosquatting_list.pb
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
typosquatting_list.pb
well_known_domains.dll
nav_config.json
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
735f92d3-20b2-4412-a433-65c2b6ada5af.tmp
iconcache_idx.db
8e7408c5-84a3-4f20-a25f-810ab2dee65c.tmp
d9485edf-e49d-4073-aacb-7cad8b20f974.tmp
fbd8612c-3f92-4f76-ab68-8c2bd34bd6fa.tmp
content_new.js
default.dic
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
Staging
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/2192-4-0x00007FFC65A80000-0x00007FFC65C89000-memory.dmp
memory/2192-5-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-12-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-9-0x00007FFC65A80000-0x00007FFC65C89000-memory.dmp
memory/2192-8-0x00007FFC65A80000-0x00007FFC65C89000-memory.dmp
memory/2192-6-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-13-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-3-0x00007FFC65B24000-0x00007FFC65B25000-memory.dmp
memory/2192-14-0x00007FFC65A80000-0x00007FFC65C89000-memory.dmp
memory/2192-7-0x00007FFC65A80000-0x00007FFC65C89000-memory.dmp
memory/2192-10-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-1-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-11-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-2-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/2192-0-0x00007FFC25B10000-0x00007FFC25B20000-memory.dmp
memory/3456-2537-0x0000000002C80000-0x0000000002D9E000-memory.dmp
memory/3456-2097-0x0000000002C80000-0x0000000002D9E000-memory.dmp
memory/3456-2732-0x0000000002C80000-0x0000000002D9E000-memory.dmp
memory/3960-1911-0x000001F4351E0000-0x000001F435200000-memory.dmp
memory/3960-2099-0x000001F47CC80000-0x000001F47CD9E000-memory.dmp
memory/3960-1934-0x000001F436430000-0x000001F436450000-memory.dmp
memory/3960-1933-0x000001F436AE0000-0x000001F436BE0000-memory.dmp
memory/3960-1909-0x000001F435F80000-0x000001F435FA0000-memory.dmp
memory/3960-1849-0x000001F401DD0000-0x000001F401ED0000-memory.dmp
memory/3960-1848-0x000001F401DD0000-0x000001F401ED0000-memory.dmp
memory/4212-601-0x000002DAAD650000-0x000002DAAD76E000-memory.dmp
memory/4424-2098-0x0000025ED9680000-0x0000025ED979E000-memory.dmp
memory/4424-2746-0x0000025ED9680000-0x0000025ED979E000-memory.dmp
memory/4424-2538-0x0000025ED9680000-0x0000025ED979E000-memory.dmp